VaryCookieSigner (optional)
- Marta Siewierska-Stańczak
https://github.com/magesuite/vary-cookie-signer
The module provides a way to verify valid cookie on varnish server by providing an extra cookie called X-Magento-Vary-Sign containing sha1 hash of X-Magento-Vary cookie content and signing key (which should be a random value)
Â
Installation
This module is optional.
composer require "creativestyle/magesuite-vary-cookie-signer" ^1.0.0Admin settings
There are no admin settings.
Backend
Motivation
Magento uses a special cookie called X-Magento-Vary to distinguish between different variants of some pages (eg. PDP page for customers with special discount).
When varnish server is used this is handled by adding content of X-Magento-Vary cookie to hash key.
This can be abused to bypass varnish page cache and generate a high load on php server by generating a random value for every request.
This extension provides a way to verify valid cookie on varnish server by providing extra cookie called X-Magento-Vary-Sign containing sha1 hash of X-Magento-Vary cookie content and the signing key (which should be a random value). Without knowing secret, attacker isn't able to generate correctly signed cookie and we can verify it on varnish server and ignore incorrect values, therefore reuse cached page.
Magento configuration
Edit the /app/etc/env.php file to configure the signing key.
...
'vary_cookie_sign' => [
'key' => 'REPLACE_THIS_WITH_SIGNING_KEY'
]
...Varnish configuration
You need to install uplex vmod_blobdigest also available as RPM in mageops repository.
Make sure you have those imports at the beginning of your VCL:
import blobdigest;
import cookie;
import blob;
Add to sub vcl_init
Add to sub vcl_recv
First if statement can only fail when update is called after finish, but this is not possible, however VCL do not allow calling object methods, therefore this function mainly as workaround to this limitation.
Â
Do not forget to replace REPLACE_THIS_WITH_SIGNING_KEY with your unique random string, and make sure you use the same value in varnish and magento.
Frontend
There are no frontend functionalities in the module.