Configure your caching servers

Make sure that DESK cookies are dropped before Varnish decides whether or not to search for the requested content from the cache. Use the vcl_recv subroutine for this. Be careful, DESK JavaScript monitoring beacons should never be cached and the cookies on them should be preserved. The beacons use the POST request method, so adding logic to only perform cookie dropping on non-POST requests should do the trick. Here is the VCL code for that:

 sub vcl_recv {
    if (req.method != "POST" && req.http.Cookie) {
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)dt(Cookie|LatC|PC|VT)=[^;]*", "");
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)rx(session|pc|latency|vt)=[^;]*", "");
        set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
        if (req.http.Cookie == "") {
            unset req.http.Cookie;
        }
    }
}

The code sample above:

• Checks if the request is a POST request and if it has a cookie header (fir pre-v4.0 VCL use req.request instead of req.method).
• It then proceeds to remove all DESK-related cookie entries using a little regular expression magic. The function regsuball replaces all occurrences matching the regex with the string given to it as the last parameter; in this case all instances of cookies named dtCookie, dtLatC, dtPC, dtVT, rxsession, rxpc, rxlatency, or rxvt.
• The next line (regsub function) makes sure that there is no leftover semicolon at the beginning of the header.
• Finally, it checks if the cookie header is empty. If it is, the entire header is removed. The non-DESK cookies are preserved and may still prevent Varnish from serving the requested content from the cache.

The above Varnish configuration is sufficient for turning caching on again, but there's one more problem we need to address: In the case of a cache miss and a subsequent call to the originating server, you need to include the DESK cookie in the request (make sure cookies are preserved in requests that can't be served from cache). This gives DESK a better understanding of the connections between your applications and web servers. You need to extend your configuration in the following way to achieve this:

sub vcl_recv {
    if (req.method != "POST" && req.http.Cookie) {
        if (req.http.Cookie ~ "(^|;\s*)dt(Cookie|LatC|PC|VT)=[^;]*" || req.http.Cookie ~ "(^|;\s*)rx(session|pc|latency|vt)=[^;]*") {
            set req.http.X-tmp-cookie = req.http.Cookie;
        }
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)dt(Cookie|LatC|PC|VT)=[^;]*", "");
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)rx(session|pc|latency|vt)=[^;]*", "");
        set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
        if (req.http.Cookie == "") {
            unset req.http.Cookie;
        }
    }
}
sub vcl_miss {
    if (req.http.X-tmp-cookie) {
        set req.http.Cookie = req.http.X-tmp-cookie;
        unset req.http.X-tmp-cookie;
    }
}

The code above:

• Adds a condition to the vcl_recv subroutine. This initially checks if there are any DESK cookies in the cookie header and, if there are, the whole cookie header is copied to a temporary header. The code then proceeds as before in removing DESK-specific cookies.
• Adds the vcl_miss subroutine, which is called in the case of a cache miss, right before the request is passed to the originating server. We want to reset the cookie header to its original state using the backup temporary header that we created earlier. After that we can remove the temporary header. Now any request that cannot be served from the cache will find the DESK cookies intact.

There's one last thing to do. Remove the DESK Set-Cookie header from the originating server responses so that they can be cached. If the DESK cookie is the only cookie being set, or if it always is the first Set-Cookie header that is set, we can use the following configuration:

sub vcl_backend_response {
    if (beresp.http.Cache-Control !~ "no-cache" && beresp.http.Set-Cookie
       && (beresp.http.Set-Cookie ~ "^dtCookie=.*" || beresp.http.Set-Cookie ~ "^rxsession=.*")) {
        unset beresp.http.Set-Cookie;
    }
}

The vcl_backend_response subroutine is called after some content has been fetched from the originating server (in older VCL versions this was called vcl_fetch). Before removing the Set-Cookie header, we first need to make sure that it exists and that it is DESK-related. The check if the Cache-Control header is set to no-cache ensures that the responses for DESK beacon requests stay intact. It's generally a good idea to avoid changing responses that will not be cached.

Now, in case we have multiple Set-Cookie headers and we cannot be sure that the one for DESK is the first, we need an alternative solution. Due to limitations with Varnish, the code above will only consider the first Set-Cookie header in the response and ignore the rest. We can work around this by installing the libvmod-header module, available from https://github.com/varnish/libvmod-header. This module contains a remove function that removes any instances of Set-Cookie that match the given parameter:

import header;
sub vcl_backend_response {
    if (beresp.http.Cache-Control !~ "no-cache") {
        header.remove(beresp.http.Set-Cookie, "dtCookie=");
        header.remove(beresp.http.Set-Cookie, "rxsession=");
    }
}