Getting Varnish To Work on Magento

Question

First please forgive me for total lack of understanding of Varnish. This is my first go at doing anything with Varnish.

I am following the example at: http://www.kalenyuk.com.ua/magento-performance-optimization-with-varnish-cache-47.html

However when I install and run this, Varnish does not seem to cache. I do get the X-Varnish header with a single number and a Via header that has a value of 1.1 varnish

I have been told (by my ISP) it is because of the following cookie that Magento sets:

Set-Cookie: frontend=6t2d2q73rv9s1kddu8ehh8hvl6; expires=Thu, 17-Feb-2011 14:29:19 GMT; path=/; domain=XX.X.XX.XX; httponly

They said that I either have to change Magento to handle this or configure Varnish to handle this. Since changing Magento is out of the question, I was wondering if someone can give me a clue as to how I would configure Varnish to handle this cookie?

Answer 1

I am assuming that's a session cookie that Magento sends to all users - I had a similar problem with Varnish + Redmine.

The reason Varnish is not caching your pages is because by default it only caches what it is sure is safe - and users with cookies typically see different things for a given page load, for example if they're logged in then maybe their username is at the top of each page, so the page can't be cached†.

Many frameworks however give session cookies to users that aren't logged in as well. I'm afraid I don't know Magento at all so I cannot predict the consequences of ignoring this cookie - on Redmine, ignoring the cookie meant that users could not log in, and all forms stopped working (because they no longer had the CSRF token).

It would probably be better to tackle this from the Magento side if you can - Varnish will listen to the upstream's headers to determine what can be cached etc.

If you can't, then you might be able to mitigate it from Varnish's configuration. You will want to ensure that the Set-Cookie header is not sent from any cache hit, and you will also want to drop the client's cookie on requests for pages where that cookie has no effect. This means you will need exceptions for things such as the login screen, or any page that requires you to be logged in (unless Magento sets a separate cookie once you are logged in, which would make things a lot easier).

The Varnish documentation (which I can highly recommend as a resource) has several pages on increasing hit rate, including one specifically for dropping cookies on some pages and not others.

† There is an exception, which is if you are using edge side includes.