Have someone experienced simmilar problem, I've installed Varnish(v3, on Debian 6, Drupal 7), and also Varnish Drupal module, conigured settings php and vcl, and everything seems to work fine, except Logged-in users sometimes get "logged out", ie when they click on link they are redirected to cached Varnish page (HIT). For pages that are MISS everything is fine.

How can in enforce for logged in user to never hit cached page, thus get logged out?

Administrative pages are working well and never express such behaviour, as i followed few tutorials/setting how to setup vcl and config files.


2 Answers 2


Maybe too late, but I had exactly the same problem, I spent two days looking for what is wrong, then I read in settings.php:

Without "Vary:Cookie", authenticated users would also be served the anonymous page from the cache.

So change 'ommit_vary_cookies' from TRUE to FALSE in settings.php solved the problem.

$conf['omit_vary_cookie'] = FALSE;
  • 2
    Just for clarity the user doesn't actually get logged out, what happens is that they receive the cached version of the page, which is the one for logged-out users. So it looks to them as though they have been logged out, although if they navigate to an uncached page, they'll get the logged-in version. Apr 18, 2013 at 15:57
  • 1
    I agree with Alfred, that was my experience too. I completely removed Varnish from my dev-live-prod because of this issue, but I will test this on my dev environment, I hope it will work for me. Upvote for now :) .
    – NenadP
    Apr 19, 2013 at 6:57
  • 1
    Yes, Alfred is right, but that's not a fault, thanks that option we can caching for logged in users, and achieve similar functionality to the authcache module.
    – malcolm
    Apr 21, 2013 at 14:33

You should use this rule in your default.vcl

# Remove all cookies that Drupal doesn't need to know about. ANY remaining
  # cookie will cause the request to pass-through to a backend. For the most part
  # we always set the NO_CACHE cookie after any POST request, disabling the
  # Varnish cache temporarily. The session cookie allows all authenticated users
  # to pass through as long as they're logged in.
  # 1. Append a semi-colon to the front of the cookie string.
  # 2. Remove all spaces that appear after semi-colons.
  # 3. Match the cookies we want to keep, adding the space we removed
  # previously, back. (\1) is first matching group in the regsuball.
  # 4. Remove all other cookies, identifying them by the fact that they have
  # no space after the preceding semi-colon.
  # 5. Remove all spaces and semi-colons from the beginning and end of the
  # cookie string.
  if (req.http.Cookie) {
    set req.http.Cookie = ";" + req.http.Cookie;
    set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
    set req.http.Cookie = regsuball(req.http.Cookie, ";(S{1,2}ESS[a-z0-9]+|NO_CACHE)=", "; \1=");
    set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
    set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");

    if (req.http.Cookie == "") {
      # If there are no remaining cookies, remove the cookie header. If there
      # aren't any cookie headers, Varnish's default behavior will be to cache
      # the page.
      unset req.http.Cookie;
    else {
      # If there is any cookies left (a session or NO_CACHE cookie), do not
      # cache the page. Pass it on to Apache directly.
      return (pass);
  • 1
    I tried thi config, but with no luck so far :(
    – NenadP
    Jan 11, 2013 at 14:52
  • 1
    more less i am using this config: fourkitchens.atlassian.net/wiki/display/TECH/…
    – NenadP
    Jan 11, 2013 at 14:53
  • 1
    I know I am late, but Varnish will not cache if it sees cookies by default. So what you need to do is look at the cache key in the header to see if the cached page is being served from drupal cache (db or memcache) and recached in varnish. Which result in this behavior.
    – awm
    Feb 21, 2014 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.