Determining if varnish config changes are needed after adding 3 new cookies

Question

# Keep all these cookie
if (req.http.Cookie) {
  set req.http.Cookie = ";" + req.http.Cookie;
  set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
  set req.http.Cookie = regsuball(req.http.Cookie, ";(location|usertype|viewed-products)=", "; \1=");
  set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
  set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");

  if (req.http.Cookie == "") {
    unset req.http.Cookie;
  }
}

I have this varnish config, and I added 3 new cookies, so do I need to change anything? In my understanding, even if I added 3 new cookies, the only cookies that will be used for determining which cached values you're going to receive from varnish are solely determined by those you keep in the configs, so they will be determined by location, usertype and viewed products. Since we only have 2 location, 3 user types and 3 products, we can't have more than 332 18 different cache values. Am I correct?

score 0 · Accepted Answer · answered Jan 18 '22 at 07:47

You're right, adding new cookies that aren't required for caching will not impact your VCL configuration.

Varnishlog output

When in doubt, use varnishlog. Here's a command you can use to monitor the cookie behavior:

varnishlog -g request -i ReqUrl -I ReqUnset:Cookie -I ReqHeader:Cookie

This command will only display the URL of the request and the various log lines where cookie values are set and unset.

Imagine sending the following HTTP request to your Varnish server:

curl -H "Cookie: foo=bar; location=test" http://localhost

This request sends 2 cookies to Varnish:

The unknown foo cookie that is supposed to be removed
The location cookie that is supposed to be kept

Here's the logging output:

*   << Request  >> 132325
-   ReqURL         /
-   ReqHeader      Cookie: foo=bar; location=test
-   ReqUnset       Cookie: foo=bar; location=test
-   ReqHeader      Cookie: ;foo=bar; location=test
-   ReqUnset       Cookie: ;foo=bar; location=test
-   ReqHeader      Cookie: ;foo=bar;location=test
-   ReqUnset       Cookie: ;foo=bar;location=test
-   ReqHeader      Cookie: ;foo=bar; location=test
-   ReqUnset       Cookie: ;foo=bar; location=test
-   ReqHeader      Cookie: ; location=test
-   ReqUnset       Cookie: ; location=test
-   ReqHeader      Cookie: location=test

As you can see, the foo cookie is nicely stripped of while the location cookie is kept.

Controlling the cache variations

I see that you're trying to keep the amount of cache variations under control, which makes sense.

The problem is that malicious requests can created unwanted cache variations.

If the amount of values per cookie are so limited, I suggested including them in your cache variation logic.

Are you using the cookie values in your vcl_hash logic for that? Or do you use Vary: Cookie for that?

Determining if varnish config changes are needed after adding 3 new cookies

1 Answers1

Varnishlog output

Controlling the cache variations