Blog/ How to cache pages by role in Varnish

Usually Varnish is used to cache pages for anonymous users but it's possible to cache pages by role as well. We have used this technique for corporate sites that are only visible under SSO. As a result, all users are authenticated but there is no user related information present on most of these pages. In this article, we'll describe how Varnish caches the pages and how the configuration can be changed to cache pages by role.

How Varnish works

Here is how Varnish works for most pages that can be cached. This is based on most Varnish configurations that I have seen being used with Drupal. When Varnish receives a page request, it removes all the cookies that are not useful for the Drupal backend, such as Google Analytics, has_js, etc. Now if there are cookies remaining such as the Drupal session cookies and ones set by Drupal modules, then Varnish does not look up the page in its cache and asks the webserver to provide that page. This is because it assumes that since there is a session cookie present, then the backend will provide a page that is specific to a user.

New configuration

In our case, even though a user is logged in (session cookie is present), we have pages that are not user-specific but are role-specific, i.e. they change from one role to another but not from one user to another if both of them have the same role. So all users who are editors will see exactly the same HTML on a page and all users who are administrators will see exactly the same HTML on a page. If there are roles for which the HTML is not identical from one user to another, then you can skip caching in Varnish for those roles. For this to work, Varnish needs to know what the role is for each page request. Unfortunately a session cookie does not provide that information. So we will set another cookie in Drupal to identify the roles and we will use it in Varnish to cache pages by role.

Here is what we have done. We created a Drupal module by the name varnish_cache_role to enable this functionality. In this module, Drupal needs to set a cookie to identify user roles. We used hook_init() in this module to do the same. Here is the code:

/**
 * Implements hook_init().
 */
function varnish_cache_role_init() {
  global $user;

  // If "Drupal_roles" cookie is not present or doesn't match the role that the user has, then set such a cookie.
  // This cookie will have all user roles separated by comma and will expire in 30 days.
  if (empty($_COOKIE['Drupal_roles']) || $_COOKIE['Drupal_roles'] != implode(',', array_values($user->roles))) {
    setcookie('Drupal.roles', implode(',', array_values($user->roles)), time()+60*60*24*30, '/');
  }
}

We need to remove this cookie when the user logs out. This can be done in hook_user_logout().

/**
 * Implements hook_user_logout().
 */
function varnish_cache_role_user_logout() {
  // Set the expiry date of the cookie to 1 so that it expires immediately.
  setcookie('Drupal.roles', '', 1, '/');
}

Now we need to change Varnish configuration so that it can parse the Drupal.roles cookie and cache pages based on it with the option to not cache pages for some roles. For this we need to first install Varnish from source and then install Varnish's Cookie module. Once you are done with these two steps, restart Varnish and then change the default.vcl file as below.

Generally Varnish's default.vcl has the following code:

if (req.http.Authorization || req.http.Cookie) {
  /* Not cacheable by default */
  return (pass);
}

Replace it by the following:

if (req.http.Authorization) {
  /* Not cacheable by default */
  return (pass);
}

So now Varnish doesn't automatically return pass if there is a cookie present. At the end of vcl_rev(), add the following code:

if (req.http.Cookie) {
  # Use Cookie module to parse the cookies in the request.
  cookie.parse(req.http.Cookie);

  # If Drupal.roles cookie is present and is "authenticated+user",
  # then look up if this page is cached.
  if (cookie.get("Drupal.roles") == "authenticated+user") {
    return (lookup);
  }

  # If cookie is "anonymous+user", then look up if this page is cached.
  if (cookie.get("Drupal.roles") == "anonymous+user") {
    return (lookup);
  }

  # If cookie is "authenticated+user;editor", then look up if the page is cached.
  if (cookie.get("Drupal.roles") == "anonymous+user;editor") {
    return (lookup);
  }

  # For any other role, do not return content from cache and instead pass the
  # request to the backend.
  else {
    return (pass);
  }
}

In the above code, we are checking that if the user is either anonymous, authenticated or editor, then look up the page in cache. For any other role, skip the cache and pass the request to backend web server. Now change the code at the end of vcl_hash() function so that pages are cached by user role.

if (req.http.Cookie) {
  # Parse the cookie string.
  cookie.parse(req.http.Cookie);

  # If Drupal.roles cookie is "authenticated+user", then use it in the hash.
  if (cookie.get("Drupal.roles") == "authenticated+user") {
    hash_data(cookie.get("Drupal.roles"));
  }

  # If Drupal.roles cookie is "anonymous+user", then use it in the hash.
  elseif (cookie.get("Drupal.roles") == "anonymous+user") {
    hash_data(cookie.get("Drupal.roles"));
  }

  # If Drupal.roles cookie is "authenticated+user;editor", then use it in the hash.
  elseif (cookie.get("Drupal.roles") == "authenticated+user;editor") {
    hash_data(cookie.get("Drupal.roles"));
  }

  # For any other role, do not use Drupal.roles cookie in the hash. This means 
  # pages for all the remaining roles will not be cached by role.
  else {
    hash_data(req.http.Cookie);
  }
}

Restart Varnish and you will see that all the pages for anonymous users, authenticated users and editors are cached in Varnish by role. Let us know how you liked this technique by leaving a comment below!