Pressflow 6 forms creating session cookies We have a Pressflow 6 website behind a Varnish cache but our cache hit-rate is awfully low. I've recently found that stripping the "Cookie" header from requests completely increases the hit-rate to 97-98%.

The vast majority of our users are anonymous, so Pressflow shouldn't be setting a session cookie, however we do have a number of forms on the site and it seems that when someone uses a form a session cookie is set in their browser. The forms aren't fancy, the page they submit to just says "thanks for your comment" so there's no need for a session as POST requests aren't cached anyway. The cookie's lifetime is about a month and a half too.

I was considering stripping the cookies when there's no "DRUPAL_UID" cookie, however I'm loath to remove them all in case there's a legitimate reason for them being set.

So, two questions:


Is there a legitimate reason for these cookies being set?
If not is my best option to get Varnish to strip them out or is
    there a way to prevent them from being set or to remove them within Pressflow?
// Default backend definition.  Set this to point to your content
// server.
// 
backend default {
  .host = "127.0.0.1";
.port = "81";
.connect_timeout = 600s;
.first_byte_timeout = 600s;
.between_bytes_timeout = 600s;
// enable to use status script for health of backend 
//  .probe = { .url = "/status.php"; .interval = 5s; .timeout = 1s; .window = 5;.threshold = 3; }
}

//
// BOOSTED VARNISH - by Trellon, LLC
// 
// - Based on a configuration by Lullabot and VCL examples for Varnish Wiki.
//
// Logic is:
// 
// * Assume: A cookie is set (we add __varnish=1 to client request to make this always true)
// * If boosted URL -&gt; unset cookie
// * If backend not healthy -&gt; unset cookie
// * If graphic or CSS file -&gt; unset cookie
// 
// Backend response:
// 
// * If no (SESSION) cookie was send in, don't allow a cookie to go out, because
//   this would overwrite the current SESSION.

// Respond to incoming requests.
sub vcl_recv {

////// START BOOST Logic (Prerequisite)
  // We always send a cookie, so that empty requests are
  // handled by below boost logic, too.
  set req.http.Cookie = ";__varnish=1;" req.http.Cookie;
////// END BOOST Logic (Prerequisite)

// Enable to disable varnish
//      return (pipe);


////// START DEFAULT RULES
 // -------- CloudFlare ----------
  remove req.http.X-Forwarded-For;
  if (req.http.CF-Connecting-IP) {
    set req.http.X-Forwarded-For = req.http.CF-Connecting-IP;
  } else {
    set req.http.X-Forwarded-For = client.ip;
  }

  // Remove a ";" prefix, if present.
  set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
  set req.http.Cookie = regsub(req.http.Cookie, "^__\s*", "");
  set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|cfduid)=[^;]*","");
  // -------- CloudFlare ----------

 if (req.request != "GET" &amp;&amp;
    req.request != "HEAD" &amp;&amp;
    req.request != "PUT" &amp;&amp;
    req.request != "POST" &amp;&amp;
    req.request != "TRACE" &amp;&amp;
    req.request != "OPTIONS" &amp;&amp;
    req.request != "DELETE") {
      // Non-RFC2616 or CONNECT which is weird.
      return (pipe);
  }
  if (req.request != "GET" &amp;&amp; req.request != "HEAD") {
    // We only deal with GET and HEAD by default
    return (pass);
  }

////// END DEFAULT RULES

  // Allow the backend to serve up stale content if it is responding slowly.
  set req.grace = 1h;

  // Do not cache these paths.
  if (req.url ~ "^/status\.php$" ||
      req.url ~ "^/sitemap\.xml$" ||
      req.url ~ "^/update\.php$" ||
      req.url ~ "^/jstats\.php$" ||
      req.url ~ "^/boost_stats\.php$" ||
      req.url ~ "^/cron\.php$" ||
      req.url ~ "^/ooyala/ping$" ||
      req.url ~ "^/admin/" ||
      req.url ~ "^/info/.*$" ||
      req.url ~ "^/flag/.*$" ||
      req.url ~ "^.*/ajax/.*$" ||
      req.url ~ "^.*/ahah/.*$") {
       return (pass);
  }

  // Pipe these paths directly to Apache for streaming.
  if (req.url ~ "^/admin/") {
    return (pipe);
  }

  // Do not allow outside access to cron.php or install.php.
  if (req.url ~ "^/(install)\.php$" &amp;&amp; !client.ip ~ internal) {
    // Have Varnish throw the error directly.
    error 404 "Page not found.";
    // Use a custom error page that you've defined in Drupal at the path "404".
    // set req.url = "/404";
  }

  // Handle compression correctly. Different browsers send different
  // "Accept-Encoding" headers, even though they mostly all support the same
  // compression mechanisms. By consolidating these compression headers into
  // a consistent format, we can reduce the size of the cache and get more hits.=
  // @see: http:// varnish.projects.linpro.no/wiki/FAQ/Compression
  if (req.http.Accept-Encoding) {
    if (req.url ~ "\.(jpg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|mp4|flv|f4v)$") {
      // No point in compressing these
      remove req.http.Accept-Encoding;
    }
    else if (req.http.Accept-Encoding ~ "gzip") {
      // If the browser supports it, we'll use gzip.
      set req.http.Accept-Encoding = "gzip";
    }
    else {
      // Unknown or deflate algorithm. Remove it and send unencoded.
      unset req.http.Accept-Encoding;
    }
  }

////// START .htaccess rewrite rules

// Strip out Google Analytics campaign variables. They are only needed
// by the javascript running on the page
// utm_source, utm_medium, utm_campaign, gclid
  if(req.url ~ "(\?|&amp;)(gclid|utm_[a-z]+)=") {
    set req.url = regsuball(req.url, "(gclid|utm_[a-z]+)=[^\&amp;]+&amp;?", "");
    set req.url = regsub(req.url, "(\?|&amp;)$", "");
  }

////// END .htaccess rewrite rules

////// START BOOST Logic

  // This is no pressflow, so we always have a SESSION

  // but boost will always set the DRUPAL_UID cookie
  // when the user is logged in.
  // 
  // So it is safe to remove all cookies for the boosted paths.
  if (!(req.http.Cookie ~ "DRUPAL_UID=")) {
     // User is anonymous

     // Boost rules from .htaccess
     if (!(req.url ~ "(^/(admin|cache|misc|modules|sites|system|openid|themes|node/add))|(/(comment/reply|edit|user|user/(login|password|register))$)")) {

////////// BOOST CONFIG: Change this to your needs
       // Boost rules from boost configuration
       if (!(req.url ~ "/(excluded-url-to-be-configured)")) {
         unset req.http.Cookie;
       }
////////// END BOOST CONFIG: Change this to your needs
    }
  }

////// END BOOST LOGIC

////// Cookie removal logic

  // Always cache the following file types for all users.
  if (req.url ~ "(?i)\.(png|gif|jpeg|jpg|ico|swf|css|js|html|htm|gz|tgz|bz2|tbz|mp3|ogg|mp4|flv|f4v|pdf)(\?[a-z0-9]+)?$") {
    unset req.http.Cookie;
  }

  // Use anonymous, cached pages if all backends are down.
  if (!req.backend.healthy) {
    unset req.http.Cookie;
  }

}

// Routine used to determine the cache key if storing/retrieving a cached page.
sub vcl_hash {
  // Include cookie in cache hash.
  // This check is unnecessary because we already pass on all cookies.
  // if (req.http.Cookie) {
  //   set req.hash += req.http.Cookie;
  // }
}

// Code determining what to do when serving items from the Apache servers.
sub vcl_fetch {

////// START BOOST Logic

  // This is no pressflow, so we always have a SESSION
  // but we only set SESSION if we actually send cookies
  //
  // So logic is: If we did not send a cookie in,
  // we do not allow a cookie out.

  if (!req.http.Cookie) {
    unset beresp.http.set-cookie;
  }

////// END BOOST LOGIC

  // Don't allow static files to set cookies.
  if (req.url ~ "(?i)\.(png|gif|jpeg|jpg|ico|swf|css|js|html|htm|gz|tgz|bz2|tbz|mp3|ogg|mp4|flv|f4v|pdf)(\?[a-z0-9]+)?$") {
    // beresp == Back-end response from the web server.
    unset beresp.http.set-cookie;
  }

  // Allow items to be stale if needed.
  set beresp.grace = 1h;

  // Serve the good page from the cache and re-check in one minute 

  if (beresp.status == 503 || beresp.status == 501 || beresp.status == 500) {
    set beresp.grace = 60s;
    restart;
  }

  // Anything that is cacheable, but has expiration date too low 
  // which prevents caching gets cached by varnish to take the 
  // load off apache.

  if (beresp.cacheable &amp;&amp; beresp.ttl &lt; 1h) {

////////// MINIMUM CACHE LIFETIME: Change this to your needs
    // Set how long Varnish will keep it
    set beresp.ttl = 1h;
////////// END MINIMUM CACHE LIFETIME: Change this to your needs

    // marker for vcl_deliver to reset Age:
    set beresp.http.magicmarker = "1";
  }


}

sub vcl_deliver {
////// START DEBUG
  if (obj.hits &gt; 0) {
    set resp.http.X-Varnish-Cache = "HIT Varnish (" obj.hits ")";
  }
  else {
    set resp.http.X-Varnish-Cache = "MISS";
  }
////// END DEBUG

  // The magic marker is used to reset the age to 0
  // as else the object is older than its ttl.  

  if (resp.http.magicmarker) {
    // Remove the magic marker
    unset resp.http.magicmarker;

    // By definition we have a fresh object
    set resp.http.Age = "0";
  }
}


// In the event of an error, show friendlier messages.
sub vcl_error {
  // Redirect to some other URL in the case of a homepage failure.
  //if (req.url ~ "^/?$") {
  //  set obj.status = 302;
  //  set obj.http.Location = "http://www.megaleecher.net";
  //}

  // Otherwise redirect to the homepage, which will likely be in the cache.
  set obj.http.Content-Type = "text/html; charset=utf-8";
  synthetic {"
&lt;html&gt;
&lt;head&gt;
  &lt;title&gt;"} obj.status " " obj.response {"&lt;/title&gt;
  &lt;style&gt;
    //page {width: 400px; padding: 10px; margin: 20px auto; border: 1px solid black; background-color: //FFF;}
    p {margin-left:20px;}
    body {background-color: //DDD; margin: auto;}
    .error { margin-left: 20px; color: //222; }
  &lt;/style&gt;
&lt;/head&gt;
&lt;body onload="setTimeout(function() { window.location = '/' }, 5000)"&gt;
  &lt;div id="page"&gt;
    &lt;h1 class="title"&gt;Page Could Not Be Loaded&lt;/h1&gt;
    &lt;p&gt;The page you requested is temporarily unavailable.&lt;/p&gt;
    &lt;p&gt;We're very sorry, but the page could not be loaded properly. This should be fixed very soon, and we apologize for any inconvenience.&lt;/p&gt;
    &lt;hr /&gt;
    &lt;p&gt;We're redirecting you to the &lt;a href="http://www.megaleecher.net"&gt;Tech Blogs Homepage&lt;/a&gt; in 5 seconds.&lt;/p&gt;
    &lt;div class="error"&gt;(Error: "} obj.status " " obj.response {")&lt;/div&gt;
  &lt;/div&gt;
&lt;/body&gt;
&lt;/html&gt;
"};
  return (deliver);
}


The above worked for me, if you are not using Cloudflare make sure to remove that section.