<div dir="ltr">Hi Timo,<div><br></div><div class="gmail_extra"><div class="gmail_quote">On Thu, Jan 9, 2014 at 2:22 PM, Myyrä, Timo <span dir="ltr"><<a href="mailto:timo.myyra@edita.fi" target="_blank">timo.myyra@edita.fi</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div>Hi,<br><br></div>I'm having trouble setting up cookie based client identity for one of our sites.<br>
</div>I'm planning on sanitising the Cookie value to only include customer specific session cookie and removing other values.<br></div></div></div></blockquote><div><br></div><div>Ok. </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div>
<br></div>Here's the relevant parts from vcl_recv:<br></div></div></blockquote><div>(..)</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">
<div><br>
# Remove cookie from static resources<br> if (req.url ~ "^assets") {<br> remove req.http.Cookie;<br> }<br></div></div></blockquote><div><br></div><div>This code probably won't be triggered as urls start with /.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Above config seems to work on when I make simple login and page tests via curl:<br>
<div><div>$ curl --cookie "FOO_SESSION=ah5ai7qaej4a006o79s9500ao5; expires=Thu, 09-Jan-2014 20:45:01 GMT; path=/foo; </div></div></div></blockquote><div><br></div><div>Here you send to cookie with curl and all is fine.</div>
<div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Problems is that when I test the site via Firefox I can login succesfully to site but when I click any link on the main page I get presented with the login page again.<br>
Seems like the varnish just droppes my cookie and wants to re-authenticate me.<br></div></div></div></blockquote><div><br></div><div>There is one potential problem with the whole approach you are using. On the first request there is no cookie. Then the cookie is created and the session is created. The cookie is passed to the client through Varnish.</div>
<div><br></div><div>Varnish doesn't know about the relationship between the session and the cookie. So Varnish will hash the cookie and might direct the client to another server, which might or might not have the session. </div>
<div><br></div><div>Then there is this:</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Here's snap of firefox varnishlog:<br>
11 VCL_Log c Cookie before sanitizing: __utma=190219199.1951064551.1362571635.1387260530.1389248604.60; __utmz=190219199.1365759373.8...<br>
11 VCL_Log c Cookie after sanitizing: <br> 11 VCL_Log c Client identity set to 192.49.50.88<br> 11 ObjHeader c Set-Cookie: FOO_SESSION=0ke75g55tvl8uglm3q95kjqf82; expires=Thu, 09-Jan-2014 21:14:38 GMT; path=/foo; domain=<a href="https://wwwdev.example.com/" target="_blank">https://wwwdev.example.com/</a>; secure; HttpOnly<br>
11 TxHeader c Set-Cookie: FOO_SESSION=0ke75g55tvl8uglm3q95kjqf82; expires=Thu, 09-Jan-2014 21:14:38 GMT; path=/foo; domain=<a href="https://wwwdev.example.com/" target="_blank">https://wwwdev.example.com/</a>; secure; HttpOnly<br>
11 VCL_Log c Cookie before sanitizing: __utma=190219199.1951064551.1362571635.1387260530.1389248604.60; __utmz=190219199.1365759373.8.2...<br> 11 VCL_Log c Cookie after sanitizing: <br> 11 VCL_Log c Client identity set to 192.49.50.88<br>
<br></div><div>As shown above, Varnish gets Set-Cookie from the application but doesn't seem to "stick" to cookie. </div></div></div></blockquote><div><br></div><div>Varnish doesn't know what Set-Cookie means. There is VCL that might trigger a hit-for-pass, but other than that there is no handling of Set-Cookie.</div>
<div><br></div><div>Also, I think the syntax of your Set-Cookie is wrong. domain should look like domain=<a href="http://example.com">example.com</a> - do not specify protocol here. So, Firefox, as it should throws the cookies away.</div>
<div><br></div><div><br></div><div>Per.</div></div><div><br></div>-- <br><div dir="ltr"><div style="font-size:12.727272033691406px;margin:5px 15px 0px 0px;padding-bottom:5px;color:rgb(34,34,34);font-family:arial,sans-serif;background-color:rgb(255,255,255)">
<table border="0" cellpadding="0" cellspacing="0" style="text-align:start;font-size:12px;line-height:1.5em;font-family:'Helvetica Neue',Arial,sans-serif;color:rgb(102,102,102);width:550px;border-top-width:1px;border-top-style:solid;border-top-color:rgb(238,238,238);border-bottom-width:1px;border-bottom-style:solid;border-bottom-color:rgb(238,238,238);margin-top:20px;padding-top:5px;padding-bottom:5px">
<tbody><tr><td width="100" style="font-family:arial,sans-serif;margin:0px"><a href="http://www.varnish-software.com/" style="color:rgb(17,85,204)" target="_blank"><img src="http://www.varnish-software.com/static/media/logo-email.png" style="float:left;margin-left:10px"></a></td>
<td style="font-family:arial,sans-serif;margin:0px"><b style="font-size:14px;color:rgb(34,34,34)">Per Buer</b><br>CTO | Varnish Software AS<br>Phone: +47 958 39 117 | Skype: per.buer<br><span style="font-weight:bold">We Make Websites Fly!<br>
<br></span><span style="font-family:'Helvetica Neue',Arial,sans-serif;font-size:14px;font-weight:bold">Winner of the Red Herring Top 100 Europe Award 2013<br></span><p style="margin:0px;line-height:normal;font-family:Helvetica">
<img src="https://www.varnish-software.com/sites/default/files/redherring_2013_winner_sml.jpg"></p><span style="font-weight:bold"><br></span></td></tr></tbody></table><div></div></div><div style="font-size:12.727272033691406px;margin:15px 0px;clear:both;color:rgb(34,34,34);font-family:arial,sans-serif;background-color:rgb(255,255,255)">
</div></div>
</div></div>