...
The module provides a way to verify valid cookie on varnish server by providing an extra cookie called X-Magento-Vary-Sign containing sha1 hash of X-Magento-Vary cookie content and signing key (which should be a random value)
| Table of Contents |
|---|
Installation
| Info |
|---|
This module is optional. |
| Code Block |
|---|
composer require "creativestyle/magesuite-vary-cookie-signer" ^1.0.0 |
Admin settings
There are no admin settings, the module is active when installed.
Backend
Motivation
Magento uses a special cookie called X-Magento-Vary to distinguish between different variants of some pages (eg. PDP page for customers with special discount).
...
This extension provides a way to verify valid cookie on varnish server by providing extra cookie called X-Magento-Vary-Sign containing sha1 hash of X-Magento-Vary cookie content and the signing key (which should be a random value). Without knowing secret, attacker isn't able to generate correctly signed cookie and we can verify it on varnish server and ignore incorrect values, therefore reuse cached page.
Magento configuration
Edit the /app/etc/env.php file to configure the signing key.
| Code Block |
|---|
...
'vary_cookie_sign' => [
'key' => 'REPLACE_THIS_WITH_SIGNING_KEY'
]
... |
Varnish configuration
You need to install uplex vmod_blobdigest also available as RPM in mageops repository.
...
Do not forget to replace REPLACE_THIS_WITH_SIGNING_KEY with your unique random string, and make sure you use the same value in varnish and magento.
Frontend
There are no frontend functionalities in the module.