Skip to content

IBX-12244: Restored refresh-instead-of-stale for logged-in users on Varnish 7 #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vidarl wants to merge 1 commit into
base: IBX-12241-varnish-cache-behat
Choose a base branch
from
+12 −8
Open

IBX-12244: Restored refresh-instead-of-stale for logged-in users on Varnish 7 #86

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion docs/varnish/vcl/varnish7.vcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,13 @@ sub vcl_recv {
}
}

// Logged-in users must not be served stale content while the backend is healthy: drop their
// grace allowance so an expired object is refetched rather than delivered from the grace
// window. varnish5/6.vcl do this in vcl_hit with return (miss), which later versions do not support.
if (req.http.cookie && std.healthy(req.backend_hint)) {
Comment on lines +65 to +66

@barw4 barw4 Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't req.http.cookie too broad? Wouldn't it make more sense to narrow it down to req.http.Cookie ~ "eZSESSID" or similar? I would say every user carries some cookie even if not logged or am I missing something?

@vidarl vidarl Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We are removing all non-session cookies earlier in the .vcl, see

http-cache/docs/varnish/vcl/varnish7.vcl

Lines 48 to 61 in f3a0a8d

// Remove all cookies besides Session ID, as JS tracker cookies and so will make the responses effectively un-cached
if (req.http.cookie) {
set req.http.cookie = ";" + req.http.cookie;
set req.http.cookie = regsuball(req.http.cookie, "; +", ";");
set req.http.cookie = regsuball(req.http.cookie, ";(eZSESSID[^=]*)=", "; \1=");
set req.http.cookie = regsuball(req.http.cookie, ";(ibexa-[^=]*)=", "; \1=");
set req.http.cookie = regsuball(req.http.cookie, ";[^ ][^;]*", "");
set req.http.cookie = regsuball(req.http.cookie, "^[; ]+|[; ]+$", "");
if (req.http.cookie == "") {
// If there are no more cookies, remove the header to get page cached.
unset req.http.cookie;
}
}

set req.grace = 0s;
}

// Do a standard lookup on assets (these don't vary by user context hash)
// Note that file extension list below is not extensive, so consider completing it to fit your needs.
if (req.url ~ "\.(css|js|gif|jpe?g|bmp|png|tiff?|ico|img|tga|wmf|svg|swf|ico|mp3|mp4|m4a|ogg|mov|avi|wmv|zip|gz|pdf|ttf|eot|wof)$") {
Expand Down Expand Up @@ -91,7 +98,7 @@ sub vcl_backend_response {
set beresp.do_esi = true;
}

// Make Varnish keep all objects for up to 1 hour beyond their TTL, see vcl_hit for Request logic on this
// Make Varnish keep all objects for up to 1 hour beyond their TTL, see vcl_recv for Request logic on this
// This will make Varnish to refresh objects in cache after 1 hour
// The total time object can be in cache is 70 minutes (grace + keep time)
set beresp.grace = 1h;
Expand Down
11 changes: 4 additions & 7 deletions features/varnish/ttl.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,14 +83,11 @@ Feature: As a site administrator I want Varnish to apply the configured TTL and
| Header | Pattern |
| x-cache-ttl | /^[0-4]\.\d+$/ |

@varnish6
@varnish6 @varnish7
Scenario: A logged-in user in the grace window gets a refreshed response, not a stale one
# varnish6.vcl vcl_hit: when the request carries a session cookie and the object is in
# grace, it does return (miss) so that editors are never shown stale content.
# varnish7.vcl has no vcl_hit at all and cannot be given the same one, because
# return (miss) was removed from that subroutine in Varnish 7 - so Varnish 7 and later
# deliver the stale object here instead. Tracked as a separate ticket; once varnish7.vcl
# gains the equivalent (return (pass)), this scenario can be tagged @varnish7 as well.
# Editors must never be shown stale content. varnish5/6.vcl enforce that in vcl_hit with
# return (miss); varnish7.vcl drops the grace allowance in vcl_recv instead, because later
# Varnish versions no longer support return (miss) there.
Given I create "Folder" Content items in root in "eng-GB"
| name | short_name |
| TestFolder | StaleAdminTestItem |
Expand Down