Bypass cache if PHPSESSID exists

[Christos Chatzaras]

Hello,

I want to bypass cache if PHPSESSID exists.

I have this configuration:

http {
        fastcgi_cache_path /tmpfs/cache levels=1:2 keys_zone=fastcgicache:10m 
inactive=10m max_size=1024m;
        fastcgi_cache_key $device_type$scheme$request_method$host$request_uri;
        fastcgi_cache_min_uses 1;
        fastcgi_cache fastcgicache;
        fastcgi_cache_valid 200 301 10s;
        fastcgi_cache_valid 302 1m;
        fastcgi_cache_valid 404 5m;
        fastcgi_cache_lock on;
        fastcgi_cache_lock_timeout 8000;
        fastcgi_pass_header Set-Cookie;
        fastcgi_pass_header Cookie;
        fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
        fastcgi_no_cache $no_cache;
        fastcgi_cache_bypass $no_cache;
}

server {

        location ~ [^/]\.php(/|$) {

                set $no_cache "";
                
                if ($request_method = POST) {
                        set $no_cache "1";
                }
                
                if ($http_cookie ~* "_mcnc|PHPSESSID") {
                        set $no_cache "1";
                }
                
                if ($no_cache = "1") {
                        add_header Set-Cookie "_mcnc=1; Max-Age=31536000; 
Path=/";
                }
        } 
}

When I repeatedly run curl, the content is fetched from the cache, and the 
Set-Cookie header always contains "PHPSESSID=604e406c1c7a6ae061bf6ce3806d5eee", 
leading to session leakage:

curl -I https://example.com
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 09 May 2024 16:37:15 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=604e406c1c7a6ae061bf6ce3806d5eee; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Cache: HIT

Any idea what's wrong with my configuration?

Kind regards,
Christos Chatzaras
_______________________________________________
nginx mailing list
nginx@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx