litespeedtech / litespeedtech/openlitespeed
Whitelist cookie headers
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.5k
- Forks
- 233
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 5
Description
It would be superbe if we could have a cookie whitelist to strip all the irrelevant cookies before checking for the cache.
Background:
I would like to have an `/about-us` delivered from the cache but when you're logged in (session cookie), I want the cache to be ignored.
If you're working with the HTTP standards (so no special `X-LiteSpeed-Vary` headers with special meanings), the only way you can achieve this is by doing this:
Response headers if not logged in:
```
Cache-Control: public, s-maxage=3600
Vary: Cookie
```
Response headers if logged in:
```
Cache-Control: no-store
```
Note that when you are logged in, **no Vary: Cookie** header is sent. So the cache is not flooded with entries. Only if the page is cacheable, we indicate that the cache shall vary on `Cookie`. That way, when you visit `/about-us` with a `Cookie` header, you will not get the cache entry.
Now the problem is with all these analytics JavaScript stuff that sets cookies (even though they could use localStorage or anything else), you will almost never hit the cache even though these cookies are actually completely irrelevant to the application back end.
Varnish also describes this issue in its documentation:
> Also, if the client sends a Cookie header, Varnish will bypass the cache and go directly to the backend.
And then it describes how you can strip all the cookies you don't want to: https://varnish-cache.org/docs/6.2/users-guide/increasing-your-hitrate.html?highlight=cookies#cookies-from-the-client
So in other words, I need to be able to configure something like this:
```
module cache {
enableCache 1
checkPublicCache 1
qsCache 1
reqCookieCache 0
reqCookieWhitelist PHPSESSID,Other-Relevant-Cookie
```
That would strip all the cookies except for `PHPSESSID` and `Other-Relevant-Cookie`.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Start by locating the cache request-cookie handling and the module cache configuration, then compare the desired behavior with the HTTP and Varnish references in the issue. Done means configurable cookie whitelisting strips irrelevant cookies while retaining listed cookies such as PHPSESSID for cache decisions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- backend, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100