title: Browser cache persists when using Varnish
body: <p>I think this seems related to Varnish. </p>
  
  <p>After I log out, user status should change. But it didn't. I have use "CTRL + F5" to force cache refreshing. </p>
  
  <p>So I am little confused. I forced refreshing of the browser cache or Varnish cache. </p>
  
  <p>If Varnish is caching the correct page ( user is not logged in), why didn't the browser display it, instead, it persists with the old page when the user still logged in.</p>
  
  <p>Any clue?</p>
  
  <blockquote>
    <p>VCL</p>
  </blockquote>
  
  <pre><code>backend testserver {
     .host = "127.0.0.1";
     .port = "8080";
  }
  
  acl purge {
     "localhost";
     "127.0.0.1";
     "192.168.3.0"/24;
  }
  
  sub vcl_recv {
     if (req.request == "PURGE") {
             if (!client.ip ~ purge) {
                     error 405 "Not allowed.";
             }
             return(lookup);
     }
     remove req.http.X-Forwarded-For;
     set req.http.X-Forwarded-For = client.ip;
     // Remove has_js and Google Analytics cookies
     set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(_[_a-z]+|has_js)=[^;]*","");
     // remove a ";" prefix, if present
     set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
  
     // remove empty cookies.
     if (req.http.Cookie ~ "^\s*$") {
       unset req.http.Cookie;
     }
  
     // Skip the Vanish cache for install, update, and cron
     if (req.url ~ "install\.php|update\.php|cron\.php") {
       return (pass);
     }
  
     # Normalize Accept-Encoding to get better cache coherency
     if (req.http.Accept-Encoding) {
       # No point in compressing media that is already compressed
       if (req.url ~ "\.(jpg|png|gif|gz|tgz|bz2|tbz|mp3|ogg)$") {
         remove req.http.Accept-Encoding;
         # MSIE 6 JS bug workaround
       } elsif(req.http.User-Agent ~ "MSIE 6") {
         unset req.http.Accept-Encoding;
       } elsif (req.http.Accept-Encoding ~ "gzip") {
         set req.http.Accept-Encoding = "gzip";
       } elsif (req.http.Accept-Encoding ~ "deflate") {
         set req.http.Accept-Encoding = "deflate";
       } else {
         # unkown algorithm
         remove req.http.Accept-Encoding;
       }
     }
  
     # ... other vcl_recv rules here ...
     # Don't serve cached content to logged-in users
     # Don't cache Drupal logged-in user sessions
     # LOGGED_IN is the cookie that earlier version of Pressflow sets
     # VARNISH is the cookie which the varnish.module sets
     if (req.http.Cookie ~ "(VARNISH|DRUPAL_UID|LOGGED_IN)") {
       return (pass);
     }
  
     // Let's have a little grace
     // When backend cannot generate refreshed content
     // this time will allow expired content to stay longer in grace
     set req.grace = 0s;
  
     if (req.http.host ~ "^www.test.com") {
             set req.backend = testserver;
             if (req.request != "GET" &amp;&amp; req.request != "HEAD") {
                     return(pipe);
             }
             else {
                     return(lookup);
             }
     }elsif (req.http.host ~ "^www.test2.com") {
             set req.backend = testserver;
             if (req.request != "GET" &amp;&amp; req.request != "HEAD") {
                     return(pipe);
             }
             else {
                     return(lookup);
             }
     }
     else {
             error 404 "test Cache Server IS Out of Order";
             return(lookup);
     }
  
     # Drupal js/css doesn't need cookies, cache them
     if (req.url ~ "^/modules/.*\.(js|css)\?") {
             unset req.http.Cookie;
     }
  
     ## Pass cron jobs and server-status
     if (req.url ~ "cron.php") {
             return (pass);
     }
     if (req.url ~ ".*/server-status$") {
             return (pass);
     } 
  }
  
  
  sub vcl_hit {
     if (req.request == "PURGE") {
             set obj.ttl = 0s;
             error 200 "Purged.";
     }
  }
  sub vcl_miss {
     if (req.request == "PURGE") {
             error 404 "Not in cache.";
     } 
  }
  sub vcl_fetch {
     if (req.url ~ "\.(png|gif|jpg|swf|css|js)$") {
       unset beresp.http.set-cookie;
     }
     #if (beresp.http.Pragma ~ "nocache") {
     #  return(pass);
     #}
     if (req.request == "GET" &amp;&amp; req.url ~ "\.(txt|js)$") {
            set beresp.ttl = 3600s;
     }
     else {
           set beresp.ttl = 30d;
     }
   }
  sub vcl_error {
    set obj.http.Content-Type = "text/html; charset=utf-8";
    set obj.http.Retry-After = "5";
    synthetic {"&lt;?xml version="1.0" encoding="utf-8"?&gt;&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0     Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;&lt;html&gt;&lt;head&gt;&lt;title&gt;"} obj.status " " obj.response {"&lt;/title&gt;&lt;/head&gt;&lt;body&gt;&lt;h1&gt;Error "} obj.status " " obj.response {"&lt;/h1&gt;&lt;p&gt;"} obj.response {"&lt;/p&gt;&lt;h3&gt;Guru Meditation:&lt;/h3&gt;&lt;p&gt;XID: "} req.xid {"&lt;/p&gt;&lt;hr&gt;&lt;p&gt;Varnish cache server&lt;/p&gt;&lt;/body&gt;&lt;/html&gt;"};
    return (deliver);
  }
  sub vcl_pipe {
    # http://www.varnish-cache.org/ticket/451
    # This forces every pipe request to be the first one.
    set bereq.http.connection = "close";
  }
  </code></pre>
  
  <blockquote>
    <p>Headers</p>
  </blockquote>
  
  <p><strong>After Log In</strong></p>
  
  <pre><code>Response Headers     view source
  Cache-Control   store, no-cache, must-revalidate, post-check=0, pre-check=0
  Connection  close
  Content-Type    text/html; charset=utf-8
  Date    Tue, 21 Feb 2012 04:09:09 GMT
  Expires Sun, 11 Mar 1984 12:00:00 GMT
  Last-Modified   Tue, 21 Feb 2012 04:09:07 GMT
  Location    http://www.test.com/frontpage_empty
  Server  nginx/1.0.0
  Set-Cookie  SESSe3202baa92dbab78a8d1785ee17b05a0=deleted; expires=Mon, 21-Feb-2011 04:09:08 GMT; path=/ SESSe3202baa92dbab78a8d1785ee17b05a0=67d001b0720c9f5a74e5b671fae74d76; expires=Fri, 09-Mar-2012 12:49:09 GMT; path=/; domain=.test.com LOGGED_IN=Y; expires=Fri, 09-Mar-2012 12:49:07 GMT; path=/
  Transfer-Encoding   chunked
  X-Powered-By    PHP/5.2.17
  Request Headers      view source
  Accept  text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Encoding gzip, deflate
  Accept-Language en-us,en;q=0.5
  Authorization   Basic amFtZXM6MTIzMTIz
  Connection  keep-alive
  Cookie  OAID=e171ed7b31967c95a09c70646433d7b1; has_js=1; SESSe3202baa92dbab78a8d1785ee17b05a0=054b6fa52ce9009198a2160800d04456; __utma=256091342.2121990614.1327109315.1329792135.1329797585.41; __utmz=256091342.1327109315.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); OAID=e171ed7b31967c95a09c70646433d7b1; SESSa395c7767e83fe1b8cd4bf8229e072c3=2bfb1adba208cf29bf17921ce9946bd5; has_js=1; __utmc=256091342; __utmb=256091342.1.10.1329797585
  Host    www.test.com
  Referer http://www.test.com/user/login?destination=frontpage_empty
  User-Agent  Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2
  Response Headers From Cache
  Cache-Control   store, no-cache, must-revalidate, post-check=0, pre-check=0
  Connection  close
  Content-Type    text/html; charset=utf-8
  Date    Tue, 21 Feb 2012 04:09:09 GMT
  Expires Sun, 11 Mar 1984 12:00:00 GMT
  Last-Modified   Tue, 21 Feb 2012 04:09:07 GMT
  Location    http://www.test.com/frontpage_empty
  Server  nginx/1.0.0
  Set-Cookie  SESSe3202baa92dbab78a8d1785ee17b05a0=deleted; expires=Mon, 21-Feb-2011 04:09:08 GMT; path=/ SESSe3202baa92dbab78a8d1785ee17b05a0=67d001b0720c9f5a74e5b671fae74d76; expires=Fri, 09-Mar-2012 12:49:09 GMT; path=/; domain=.test.com LOGGED_IN=Y; expires=Fri, 09-Mar-2012 12:49:07 GMT; path=/
  Transfer-Encoding   chunked
  X-Powered-By    PHP/5.2.17
  Request Headers From Upload Stream
  Content-Length  61
  Content-Type    application/x-www-form-urlencoded
  </code></pre>
  
  <p><strong>After log out</strong></p>
  
  <pre><code>Response Headers    view source
  Cache-Control   store, no-cache, must-revalidate, post-check=0, pre-check=0
  Connection  close
  Content-Type    text/html; charset=utf-8
  Date    Tue, 21 Feb 2012 09:10:29 GMT
  Expires Sun, 11 Mar 1984 12:00:00 GMT
  Last-Modified   Tue, 21 Feb 2012 09:10:27 GMT
  Location    http://www.test.com/
  Server  nginx/1.0.0
  Set-Cookie  LOGGED_IN=deleted; expires=Mon, 21-Feb-2011 09:10:28 GMT; path=/
  Transfer-Encoding   chunked
  X-Powered-By    PHP/5.2.17
  Request Headers     view source
  Accept  text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Encoding gzip, deflate
  Accept-Language en-us,en;q=0.5
  Authorization   Basic amFtZXM6MTIzMTIz
  Connection  keep-alive
  Cookie  SESSe3202baa92dbab78a8d1785ee17b05a0=67d001b0720c9f5a74e5b671fae74d76; __utma=256091342.2121990614.1327109315.1329792135.1329797585.41; __utmz=256091342.1327109315.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); OAID=e171ed7b31967c95a09c70646433d7b1; SESSa395c7767e83fe1b8cd4bf8229e072c3=2bfb1adba208cf29bf17921ce9946bd5; has_js=1; __utmc=256091342; LOGGED_IN=Y
  Host    www.test.com
  If-Modified-Since   Tue, 21 Feb 2012 03:32:36 GMT
  Referer http://www.test.com/
  User-Agent  Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2
  </code></pre>