I've set up cloudflare caching of Drupal's frontpage by adding a Page Rule for my Drupal base URL, with a "Cache Everyting" setting (otherwise, caching is enabled only for certain file extensions). I've installed the Cloudflare module, and enabling $conf['reverse_proxy'].

However, it seems that after authenticating, users see the anonymous homepage. If I go to /drupal/user, I see the user's page (so I know login works). I don't understand how this happens, since the Drupal anonymous pages are supposed to set 'Vary: Cookie' (which Cloudflare supposedly obeys), and authenticated users should send a session cookie.

Is anyone using cloudflare successfully for dynamic content? What settings would help? Any ideas?

NOTE. I haven't set conf['omit_vary_cookie']. Debugging with curl -I shows the appropriate Vary: Cookie,Accept-Encoding. Under Firefox, after authenticating, a request to /drupal/ sends a session cookie.

  • "Drupal anonymous pages are supposed to set 'Vary: Cookie'" - so is it happening on your site? You can test it, we can't. – Mołot May 29 '15 at 14:10
  • I haven't set conf['omit_vary_cookie']. curl -I shows Vary: Cookie,Accept-Encoding. In Firefox, after authentication, a request to /drupal/ contains a session cookie, but the response from drupal/cloudflare only has Vary: Accept-Encoding (as well as X-Drupal-Cache:Hit and CF-Cache-Status:Hit) – dan3 May 29 '15 at 14:17
  • If cookie is supposed to be set, or header to be sent, but is not, then it is a bug in core or module, and should be resolved in module's issue queue. If header is sent and cookie set, but browser or caching server ignores it - then it's their bug. Hard to tell now. – Mołot May 29 '15 at 14:21
  • 1
    Even without cloudflare, the response from /drupal/ to an authenticated request contains only Vary:Accept-Encoding, not Vary:Cookie (but in that case it also contains the proper authenticated page, as well as Cache-Control:no-cache etc). I think that's the way Drupal does things. But Cloudflare shouldn't normally send a cached page if the request has a session cookie... – dan3 May 29 '15 at 14:25
  • ... I'm a little surprised I don't find more articles on the web on Drupal + Cloudflare... Avoiding a server hit for the anonymous frontpage (and the individual nodes) should be a common use-case. – dan3 May 29 '15 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.