6

I am trying to set up Drupal 7 with Authcache beta 2 and Varnish 3.0 but I can't get the ESI blocks working. Varnish it self seems to work well.

I am using the example.vcl from sites/all/modules/authcache/modules/authcache_varnish/ but on the Authcache ESI status debug page I get the following messages:

ERROR: Request Header   HTTP header X-Authcache-Do-ESI is not on primary request.
Please make sure that the reverse proxy software (varnish) is configured according to the requirements of authcache_esi / authcache_varnish.

OK  ESI Tag Tag successfully substituted by reverse proxy.

ERROR: ESI Subrequest Header    HTTP header X-Authcache is not on ESI subrequest.
Please make sure that the reverse proxy software (varnish) is configured according to the requirements of authcache.

The second problem is that even if I configure some blocks on the blocks setting page to load via ESI and AJAX, this block do not show up at admin/config/system/authcache/p13n and admin/config/system/authcache/p13n/frontcontroller.

There for it does not surprise that watchdog gives the error message (for each block):

Failed to find url generator for route frag/block/block-25

EDIT: My setting.php is set up as follows:

$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = array('127.0.0.1');
/**
 * Add Varnish as the page cache handler.
 */
$conf['cache_backends'][] = 'sites/all/modules/varnish/varnish.cache.inc';
$conf['cache_backends'][] = 'sites/all/modules/authcache/authcache.cache.inc';
$conf['cache_backends'][] = 'sites/all/modules/authcache/modules/authcache_builtin/authcache_builtin.cache.inc';
$conf['cache_class_cache_page'] = 'VarnishCache';
// Drupal 7 does not cache pages when we invoke hooks during bootstrap.
// This needs to be disabled.
$conf['page_cache_invoke_hooks'] = FALSE;

I didn't find any documentations so what am I supposed to do?

  • Sorry for the lack of documentation, it is in the works and I'm adding new pages here as I find time. Does it help when you hit the "Rebuild routes" button at the bottom of admin/config/system/authcache/p13n/frontcontroller? Do you run MySQL with MyISAM, then issue #2161061 has some information and a patch. – znerol Dec 23 '13 at 10:20
  • And another thing: There is a README detailing the changes necessary for settings.php. – znerol Dec 23 '13 at 10:33
  • @znerol I know, that documentation is boring and time consuming wok. So, no reason to apologize, but reason for me to thank you for the great work an the fast replay. I already followed the instructions in the README but can't get it working anyway. I updated my post with the current set up of my setting.php. I tried "Rebuild routes" as well without any effort. – user5950 Dec 23 '13 at 14:25
  • If you are testing on localhost, ensure that you are connecting to varnish on a different IP than varnish is connecting to the backend. See also issue #7920721 comment #31 – znerol Dec 23 '13 at 16:16
  • 2
    I've added a documentation page now: Authcache 2 recipe: Upgrade to Varnish and ESI. I hope this will clarify many things. – znerol Dec 25 '13 at 10:54
0

When using this file I had to scroll down to line 142 and change this:

  if (req.restarts == 0 && server.identity !~ "^/tmp/vtc.") {
    unset req.http.X-Authcache-Do-ESI;
    unset req.http.X-Authcache-Get-Key;
    unset req.http.X-Authcache-Key-CID;
    unset req.http.X-Authcache-Key;
  }

into this:

  if (req.restarts == 0 && server.identity !~ "^/tmp/vtc.") {
    unset req.http.X-Authcache-Do-ESI;
    unset req.http.X-Authcache-Get-Key;
    unset req.http.X-Authcache-Key-CID;
    unset req.http.X-Authcache-Key;
  }

  set req.http.X-Authcache = 1; // Added by me
  set req.http.X-Authcache-Do-ESI = 1; // Added by me

I'm not sure why those headers are not added but instead removed in the default version, since the module seems to require them to be present in the first incoming request. However, given the nature of those headers, they seem to make more sense when returned from the backend to Varnish than the opposite. znerol might have a good answer for you (and for me) why they are required in the first request.

I also wanna say thank you znerol for this amazing module and for the ongoing documentation work.

  • 1
    The req.http.X-Authcache-X headers are used as flags throughout the VCL. Those need to be reset on the beginning of each request, such that attackers cannot tamper with them. Please do not tamper with them and even more important, do not encourage anyone to do it. – znerol Jan 2 '14 at 17:24
  • Well, user5950 here gets the following error: ERROR: Request Header HTTP header X-Authcache-Do-ESI is not on primary request. How is this supposed to disappear if you do not include this header in the primary request? Please also note that in my example, any headers sent from the client (such as the X-Authcache-Key) is still removed. So an attacker will not be able to spoof a key and see the cached content of anyone else. – Nord Jan 2 '14 at 17:46
  • Furthermore, to stop attackers, I had to move 5 lines down and change if (req.restarts == 0 && req.url ~ "^/authcache-varnish-get-key") { into if (req.restarts == 0 && req.url ~ "(?q=|/)authcache-varnish-get-key") {. Otherwise this line makes no sense. – Nord Jan 2 '14 at 18:00
  • The X-Authcache as well as X-Authcache-Do-ESI header is added to the request conditionally from within vcl_miss. The header is only added if the response is going to be cached otherwise it does not make sense to allow ESI processing anyway. – znerol Jan 2 '14 at 18:02
  • Regarding authcache-varnish-get-key: Please file a bug report – znerol Jan 2 '14 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.