title: how remove PHPSESSIONID from varnish cache
body: <p>i have a persistent problem with varnish for specific site, varnish in other site (work fine after follow the official guide of varnish-wordpress)<a href="https://www.varnish-software.com/blog/step-step-speed-wordpress-varnish-software" rel="nofollow">https://www.varnish-software.com/blog/step-step-speed-wordpress-varnish-software</a></p>
  
  <p>on the same server have other site (no cms), this site have problem with caching from varnish , in the header show max age= 0 , so not cache , probable because have a cookie PHPSESSIONID, i have test every guide online , but without solution.</p>
  
  <p>this is my header:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: Apache/2.2.27 (Unix) mod_ssl/2.2.27 OpenSSL/1.0.1e-fips
  X-Powered-By: PHP/5.4.27
  Set-Cookie: PHPSESSID=xxxxxxxxxxxxxxxxxxxxxx; path=/
  Content-Type: text/html
  Content-Length: 40627
  Accept-Ranges: bytes
  Date: Sat, 27 Jun 2015 10:56:14 GMT
  X-Varnish: 1838947681
  Age: 0
  Via: 1.1 varnish
  Connection: keep-alive
  </code></pre>
  
  <p>and this is my default.vcl :</p>
  
  <pre><code># This is a basic VCL configuration file for varnish.  See the vcl(7)
  # man page for details on VCL syntax and semantics.
  # 
  # Default backend definition.  Set this to point to your content
  # server.
  # 
  backend default {
    .host = "127.0.0.1";
    .port = "82";
  }
  # 
  # Below is a commented-out copy of the default VCL logic.  If you
  # redefine any of these subroutines, the built-in logic will be
  # appended to your code.
  # sub vcl_recv {
  #     if (req.restarts == 0) {
  #   if (req.http.x-forwarded-for) {
  #       set req.http.X-Forwarded-For =
  #       req.http.X-Forwarded-For + ", " + client.ip;
  #   } else {
  #       set req.http.X-Forwarded-For = client.ip;
  #   }
  #     }
  #     if (req.request != "GET" &amp;&amp;
  #       req.request != "HEAD" &amp;&amp;
  #       req.request != "PUT" &amp;&amp;
  #       req.request != "POST" &amp;&amp;
  #       req.request != "TRACE" &amp;&amp;
  #       req.request != "OPTIONS" &amp;&amp;
  #       req.request != "DELETE") {
  #         /* Non-RFC2616 or CONNECT which is weird. */
  #         return (pipe);
  #     }
  #     if (req.request != "GET" &amp;&amp; req.request != "HEAD") {
  #         /* We only deal with GET and HEAD by default */
  #         return (pass);
  #     }
  #     if (req.http.Authorization || req.http.Cookie) {
  #         /* Not cacheable by default */
  #         return (pass);
  #     }
  #     return (lookup);
  # }
  # 
  # sub vcl_pipe {
  #     # Note that only the first request to the backend will have
  #     # X-Forwarded-For set.  If you use X-Forwarded-For and want to
  #     # have it set for all requests, make sure to have:
  #     # set bereq.http.connection = "close";
  #     # here.  It is not set by default as it might break some broken web
  #     # applications, like IIS with NTLM authentication.
  #     return (pipe);
  # }
  # 
  # sub vcl_pass {
  #     return (pass);
  # }
  # 
  # sub vcl_hash {
  #     hash_data(req.url);
  #     if (req.http.host) {
  #         hash_data(req.http.host);
  #     } else {
  #         hash_data(server.ip);
  #     }
  #     return (hash);
  # }
  # 
  # sub vcl_hit {
  #     return (deliver);
  # }
  # 
  # sub vcl_miss {
  #     return (fetch);
  # }
  # 
  # sub vcl_fetch {
  #     if (beresp.ttl &lt;= 0s ||
  #         beresp.http.Set-Cookie ||
  #         beresp.http.Vary == "*") {
  #       /*
  #        * Mark as "Hit-For-Pass" for the next 2 minutes
  #        */
  #       set beresp.ttl = 120 s;
  #       return (hit_for_pass);
  #     }
  #     return (deliver);
  # }
  # 
  # sub vcl_deliver {
  #     return (deliver);
  # }
  # 
  # sub vcl_error {
  #     set obj.http.Content-Type = "text/html; charset=utf-8";
  #     set obj.http.Retry-After = "5";
  #     synthetic {"
  # &lt;?xml version="1.0" encoding="utf-8"?&gt;
  # &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  #  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
  # &lt;html&gt;
  #   &lt;head&gt;
  #     &lt;title&gt;"} + obj.status + " " + obj.response + {"&lt;/title&gt;
  #   &lt;/head&gt;
  #   &lt;body&gt;
  #     &lt;h1&gt;Error "} + obj.status + " " + obj.response + {"&lt;/h1&gt;
  #     &lt;p&gt;"} + obj.response + {"&lt;/p&gt;
  #     &lt;h3&gt;Guru Meditation:&lt;/h3&gt;
  #     &lt;p&gt;XID: "} + req.xid + {"&lt;/p&gt;
  #     &lt;hr&gt;
  #     &lt;p&gt;Varnish cache server&lt;/p&gt;
  #   &lt;/body&gt;
  # &lt;/html&gt;
  # "};
  #     return (deliver);
  # }
  # 
  # sub vcl_init {
  #   return (ok);
  # }
  # 
  # sub vcl_fini {
  #   return (ok);
  # }
  </code></pre>
  
  <p>this some setting have follow:
  1)</p>
  
  <pre><code>sub vcl_recv {
      // Remove all cookies except the session ID.
      if (req.http.Cookie) {
          set req.http.Cookie = ";" + req.http.Cookie;
          set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
          set req.http.Cookie = regsuball(req.http.Cookie, ";(PHPSESSID)=", "; \1=");
          set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
          set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
  
          if (req.http.Cookie == "") {
              // If there are no more cookies, remove the header to get page cached.
              remove req.http.Cookie;
          }
      }
  }
  </code></pre>
  
  <p>2)</p>
  
  <pre><code>sub vcl_fetch {
    if (!(beresp.http.Set-Cookie ~ "LOGIN") &amp;&amp; !(req.http.cookie ~ "LOGIN")) {
      unset beresp.http.Pragma;
      unset beresp.http.Set-Cookie;
      set beresp.http.Cache-Control = "public; max-age=1800";
      unset beresp.http.Expires;
      set beresp.ttl = 30m;
      return (deliver);
    }
  }
  
  sub vcl_recv {
    if (req.http.Cookie ~ "LOGIN") {
      set req.http.Cookie = ";" req.http.Cookie;
      set req.http.Cookie = regsuball(req.http.Cookie, "; +", ";");
      set req.http.Cookie = regsuball(req.http.Cookie, ";(PHPSESSID|LOGIN)=", "; 1=");
      set req.http.Cookie = regsuball(req.http.Cookie, ";[^ ][^;]*", "");
      set req.http.Cookie = regsuball(req.http.Cookie, "^[; ]+|[; ]+$", "");
      if (req.http.Cookie == "") {
        remove req.http.Cookie;
      }
    } else {
      remove req.http.Cookie;
    }
  }
  </code></pre>
  
  <p>AND ALSO THIS : <a href="https://www.varnish-cache.org/trac/wiki/VCLExampleRemovingSomeCookies" rel="nofollow">https://www.varnish-cache.org/trac/wiki/VCLExampleRemovingSomeCookies</a></p>
  
  <p>other idea ?</p>