PHP session causes varnish not to cache

Question

I'm struggling to understand the behavior of varnish and was hoping some one can shed some light.

I'm doing a test where I'm trying to make varnish to cache requests/responces with cookies.

I have a very simple PHP script, it simple start a session.

<?php session_start(); ?>

I do expect varnish not to cache due Set-Cookie and Cookie headers.

I'll go and unset these headers:

sub vcl_backend_response {
    unset beresp.http.set-cookie;
}

sub vcl_recv {
    unset req.http.cookie;
}

The requested page is still not being cached.

I know that PHP will send a cache-busting headers which might be respected by varnish. Let's check:

<?php echo session_cache_limiter(); ?>

Output: nocache

From session_cache_limiter() documentation it is known that nocache wills send these responce headers to bust the cache:

Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache

Let's unset them:

sub vcl_backend_response {
    unset beresp.http.expires;
    unset beresp.http.pragma;
    unset beresp.http.cache-control;
    unset beresp.http.set-cookie;
}

As this point I would expect varnish to cache, however still no cache.

The fix which worked is to set a ttl:

sub vcl_backend_response {
    unset beresp.http.expires;
    unset beresp.http.pragma;
    unset beresp.http.cache-control;
    unset beresp.http.set-cookie;

    # THIS MADE VARNISH TO CACHE
    set beresp.ttl = 10m;
}

And now the question:

Why would I need to set TTL explicitly if the default value is 2m (-t 120 in the CLI below) and all cache-busting headers are taken care of?

/usr/sbin/varnishd -P /var/run/varnish.pid -f /etc/varnish/default.vcl -a :80 -T 0.0.0.0:6082 -t 120 -u varnish -g varnish -S /etc/varnish/secret -s malloc,512M

Am I missing something? Is there a different way, whitout setting TTL (which I would prefer)?

Steve Easley Steve Easley · Accepted Answer · 2015-08-06T13:40:24

The issue is Varnish evaluates the Expires backend response header before vcl_backend_response is called. The result is the object passed to vcl_backend_response has an expired TTL already (assuming the header had an expired date). The next client request will hit on the cached object, but get a miss since the object is expired (HIT-FOR-PASS). Yes you are unsetting the Expires header (via unset beresp.http.expires;), but its too late by then.

Now whether this is a bug, or the Varnish developers interpretation of the RFCs I am not sure.

I understand your code may just be for testing purposes, but you are better off not battling cache headers in VCL. Either call PHP's session_cache_limiter() with the appropriate value (public, private, nocache), or disable it (session_cache_limiter('')) and control the headers yourself.

If you are using PHP sessions, you still have to deal with the cookie headers making it uncacheable, but thats another issue beyond the scope of the question.

PHP session causes varnish not to cache

1 Answers