<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="text-align:left; direction:ltr;">
<div>Hi Guillaume,</div>
<div><br>
</div>
<div>Thumbs up for your cache_req_body() hint. It works perfect now. Thank you very much for your help.</div>
<div><br>
</div>
<div>TIL: POST, PUT, … requests are not restart-able by default.</div>
<div><br>
</div>
<div>tom</div>
<div><br>
</div>
<div><br>
</div>
<div>Am Dienstag, dem 26.07.2022 um 00:50 -0700 schrieb Guillaume Quintard:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<div dir="auto">Hi!
<div dir="auto"><br>
</div>
<div dir="auto">You are correct, the request body is, by default, not cached. To correct this, you need to use the cache_req_body() function from the std vmod:
<a href="https://varnish-cache.org/docs/trunk/reference/vmod_std.html#std-cache-req-body">
https://varnish-cache.org/docs/trunk/reference/vmod_std.html#std-cache-req-body</a></div>
<div dir="auto"><br>
</div>
<div dir="auto"><self promotion time></div>
<div dir="auto">I haven't looked at the vcl yet (or the article), but since you mention vmod_curl, maybe you can try with vmod_reqwest instead (<a href="https://github.com/gquintard/vmod_reqwest">https://github.com/gquintard/vmod_reqwest</a>). It's a bit different,
but hopefully more powerful, and I'd love to get some feedback on it.</div>
</self promotion time>
<div dir="auto"><br>
</div>
<div dir="auto">Hope that helps!<br>
<br>
<div class="gmail_quote" dir="auto">
<div dir="ltr" class="gmail_attr">On Tue, Jul 26, 2022, 00:03 Tom Anheyer | BerlinOnline <<a href="mailto:tom.anheyer@berlinonline.de">tom.anheyer@berlinonline.de</a>> wrote:<br>
</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
Hello,<br>
<br>
I try to use vouch-proxy and varnish (v7) together to build a authorisation<br>
proxy. vouch-proxy is written to work with nginx ngx_http_auth_request_module<br>
<br>
<a href="https://github.com/vouch/vouch-proxy" rel="noreferrer noreferrer" target="_blank">https://github.com/vouch/vouch-proxy</a><br>
<a href="https://nginx.org/en/docs/http/ngx_http_auth_request_module.html" rel="noreferrer noreferrer" target="_blank">https://nginx.org/en/docs/http/ngx_http_auth_request_module.html</a><br>
<br>
Idea:<br>
<br>
inspired from <br>
<a href="https://web.archive.org/web/20121124064818/https://adayinthelifeof.nl/2012/07/06/using-varnish-to-offload-and-cache-your-oauth-requests/" rel="noreferrer noreferrer" target="_blank">https://web.archive.org/web/20121124064818/https://adayinthelifeof.nl/2012/07/06/using-varnish-to-offload-and-cache-your-oauth-requests/</a><br>
<br>
- use varnish request restart feature<br>
- intercept original client request and make a GET request to vouch-proxy<br>
validate endpoint<br>
- when validated restore the original request and do a restart <br>
<br>
in detail:<br>
<br>
# vcl_recv<br>
# restarts == 0<br>
# save req method, url, Content-Length, Content-Type in var<br>
# method := GET<br>
# url := /validate<br>
# backend := vouch-proxy<br>
# remove Content-Length, Content-Type<br>
# restarts > 0<br>
# check vouch-proxy headers (roles, groups)<br>
#<br>
# vcl_deliver<br>
# resp == vouch-proxy,GET,/validate,200<br>
# restore req method, url, Content-Length, Content-Type from var<br>
# forward vouch-proxy response headers to req<br>
# restart (original) req<br>
<br>
see attached common-vouch-proxy.vcl<br>
<br>
It works for client requests without request body (GET, HEAD, …) but not for<br>
POST, PUT, …. POST, PUT run in timeouts, so I think the request body is lost in<br>
the restarted request. Why is the body gone after restart?<br>
<br>
I think it should work with the curl vmod but this is not integrated yet.<br>
<br>
Thank you very much in advance<br>
tom<br>
<br>
</blockquote>
</div>
</div>
</div>
</blockquote>
<div><span>
<pre>-- <br></pre>
<div style="width: 80ch;">Tom Anheyer</div>
<div style="width: 80ch;">Senior Developer</div>
<div style="width: 80ch;"><br>
</div>
<div style="width: 80ch;">
<div style="width: 80ch;">BerlinOnline Stadtportal GmbH & Co. KG</div>
<div style="width: 80ch;">Stefan-Heym-Platz 1</div>
<div style="width: 80ch;">10365 Berlin</div>
<div style="width: 80ch;">Germany</div>
<div style="width: 80ch;"></div>
</div>
<div style="width: 80ch;"><br>
</div>
<div style="width: 80ch;">Tel.: +49 30 2327-5210</div>
<div style="width: 80ch;">Fax: +49 30 5771180-95</div>
<div style="width: 80ch;">E-Mail: <a href="mailto:tom.anheyer@berlinonline.de">tom.anheyer@berlinonline.de</a></div>
<div style="width: 80ch;"><br>
</div>
<div style="width: 80ch;">berlin.de | berlinonline.net</div>
<div style="width: 80ch;"></div>
<div style="width: 80ch;"><br>
</div>
<div style="width: 80ch;">
<div style="width: 80ch;">Amtsgericht Berlin-Charlottenburg, HRA 31951</div>
<div style="width: 80ch;">Sitz der Gesellschaft: Berlin, Deutschland</div>
<div style="width: 80ch;">USt-IdNr.: DE219483549</div>
<div style="width: 80ch;"><br>
</div>
<div style="width: 80ch;">Persönlich haftender Gesellschafter:</div>
<div style="width: 80ch;">BerlinOnline Stadtportalbeteiligungsges. mbH</div>
<div style="width: 80ch;">Amtsgericht Berlin-Charlottenburg, HRB 79077</div>
<div style="width: 80ch;">Sitz der Gesellschaft: Berlin, Deutschland</div>
<div style="width: 80ch;"><br>
</div>
<div style="width: 80ch;">Geschäftsführung: Olf Dziadek, Andreas Mängel</div>
<div style="width: 80ch;">Amtierender Vorsitzender des Aufsichtsrates: Lothar Sattler</div>
<div style="width: 80ch;"></div>
</div>
<div style="width: 80ch;"></div>
</span></div>
</body>
</html>