Prevent varnish from caching cookie response

Question

When varnish returns a cache, does it also return the cookie generated on the backend or only the css, images and html returned to the frontend? I had users tell me that they kept getting the wrong cookies, so I am thinking because the cookies are based on geolocation data that the reason was the varnish cache. If it is so, is there a way to prevent varnish to return any cached data for cookies?

Answer 1

Varnish's built-in VCL behavior will send Set-Cookie headers that were send by the origin server to the client. This will allow the client to have the appropriate cookie set in the browser.

However, because a Set-Cookie header implies a state change, Varnish will not store these results in cache and will return a so-called Hit-For-Miss object for the next 2 minutes.

This means that the next request for that object will automatically bypass the cache. If any of the subsequent backend responses no longer contain the Set-Cookie header, Varnish will consider the response to be cacheable.

See https://github.com/varnishcache/varnish-cache/blob/6.0/bin/varnishd/builtin.vcl#L157-L165 for the built-in VCL that defines this behavior.

Unless your VCL actively intervenes with logic in the vcl_backend_response subroutine, the default behavior will always be in effect and responses containing Set-Cookie headers will not be cached.

Please share your VCL to see whether or not this is the case.