Going crazy with caching

Caching pages of logged in users

Bulgaria PHP Conference,
September 26th, 2015

© David Buchmann

HTTP Caching

• Why re-render content that does not change?
• Scaling and response time
• Less servers, more users

What is a reverse proxy again?

VCL Hook Functions

• vcl_recv: entry point, lookup or pass
• vcl_fetch: receive from backend, cache or not
• vcl_deliver: remove headers not for client
• vcl_hash: determine cache key
• vcl_hit: found in cache, deliver or pass
• vcl_miss: pass or fetch
• vcl_pipe: do not alter request
• vcl_error: define error page

Default Varnish behaviour

• Only attempt to cache GET and HEAD request
• Never cache request with cookies / authorization
• Never cache response with set-cookie
• Only cache safe responses (status 200, 203, 300, 301, 302, 307, 404, 410)

Default Varnish behaviour

• Only attempt to cache GET and HEAD request
• Never cache request with cookies / authorization
• Never cache response with set-cookie
• Only cache safe responses (status 200, 203, 300, 301, 302, 307, 404, 410)

Strategies when working with sessions

• Avoid Sessions, remove when no longer needed
• Cache lookup despite cookies
  • Prevent caching when specific
  • Vary on Cookie header
• User Context: Cache by group

Avoid Sessions

Avoid Session

• Delete cookie as soon as no longer needed
• Watch out for autostarted PHP sessions

if (isset($_COOKIE[session_name()])) {
    setcookie(session_name(), '', time()-3600);
}
            

Cleanup Cookies: Remove all but session cookie

sub vcl_recv {
    set req.http.cookie = ";" + req.http.cookie;
    set req.http.cookie = regsuball(req.http.cookie, "; +", ";");
    set req.http.cookie = regsuball(req.http.cookie, ";(PHPSESSID)=", "; \1=");
    set req.http.cookie = regsuball(req.http.cookie, ";[^ ][^;]*", "");
    set req.http.cookie = regsuball(req.http.cookie, "^[; ]+|[; ]+$", "");
    if (req.http.Cookie == "") {
        remove req.http.Cookie;
    }
}
            

varnish-cache.org/trac/wiki/VCLExampleRemovingSomeCookies #RemovingallBUTsomecookies

Cache lookup despite cookies

Cache lookup despite cookies

• Very easy to shoot yourself in the foot!
• The backend must send correct cache headers
  • Not cacheable:

    Cache-Control: no-cache

  • Depends on session:

    Vary: Cookie

  • Static:

    Cache-Control: public, s-maxage: ...

builtin.vcl

                // builtin.vcl
                sub vcl_recv {
                    // ...
                    if (req.method != "GET" && req.method != "HEAD") {
                        /* We only deal with GET and HEAD by default */
                        return (pass);
                    }
                    if (req.http.Authorization || req.http.Cookie) {
                        /* Not cacheable by default */
                        return (pass);
                    }

                    return (hash);
                }
            

Cache lookup despite cookies

                // default.vcl
                sub vcl_recv {
                    // ...
                    if (req.method != "GET" && req.method != "HEAD") {
                        /* We only deal with GET and HEAD by default */
                        return (pass);
                    }

                    return (hash);
                }
            

User Context

Introducing the User Context Hash

• Group based caching
• Transparent (reverse proxy does most of the job)
• Computed for every user in application (footprint)
• Hash generation can be customized
• Cached by session ID, using HTTP cache of course!

User Context