nexcess / magento-turpentine

A Varnish extension for Magento.
GNU General Public License v2.0
519 stars 253 forks source link

FormKey issues (URLs without / at the end) #1541

Open DevYevhen opened 5 years ago

DevYevhen commented 5 years ago

FormKey ESI Response gets cached with wrong access settings (and served to all users) if router was changed to generate URLs without / at the end. (/turpentine/esi/getFormKey/ttl//method/esi/scope/global/access/private) Symptoms are:

req.http.X-Varnish-Esi-Access calculation regex awaits URL with / at the end. If / is absent, then req.http.X-Varnish-Esi-Access would be wrong and vcl_hash will not add frontend cookie to hash calculation. Original regex:

set req.http.X-Varnish-Esi-Access = regsub(
                req.url, ".*/{{esi_cache_type_param}}/(\w+)/.*", "\1");

could be changed to something like that:

set req.http.X-Varnish-Esi-Access = regsub(
                req.url, ".*/{{esi_cache_type_param}}/(\w+)(/|\z).*", "\1");

to resolve issue.