title: Maintain session for ESI-included requests
body: <p>I'm having trouble setting up Varnish to properly handle session cookie for ESI-included subrequests.</p>
  
  <h2>Background, <a href="http://sscce.org/" rel="nofollow">SSCCE</a></h2>
  
  <p>Three files: <code>index.php</code>, <code>navigation.php</code> and <code>footer.php</code> combined together using ESI, where first two files are stateful, but only <code>index.php</code> is cachable, while <code>footer.php</code> is completley stateless.</p>
  
  <pre><code>### index.php
  &lt;?php
  
  session_start();
  
  header('Cache-Control: public, s-maxage=10');
  header('Surrogate-Control: content="ESI/1.0"');
  
  ?&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html&gt;
      &lt;head&gt;
          &lt;meta charset="utf-8" /&gt;
  
          &lt;title&gt;Varnish test&lt;/title&gt;
      &lt;/head&gt;
      &lt;body&gt;
          &lt;esi:include src="http://localhost/WWW/navigation.php" /&gt;
          &lt;p&gt;Primary content: &lt;?php echo date('r') ?&gt;&lt;/p&gt;
          &lt;esi:include src="http://localhost/WWW/footer.php" /&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  
  ### footer.php
  &lt;?php
  
  header('Cache-Control: public, s-maxage=20');
  
  ?&gt;
  &lt;p&gt;Footer: &lt;?php echo date('r') ?&gt;&lt;/p&gt;
  
  ### navigation.php
  &lt;?php
  
  session_start();
  
  if (!isset($_SESSION['counter'])) {
      $_SESSION['counter'] = 0;
  }
  
  $_SESSION['counter'] += 1;
  
  header('Cache-Control: private');
  
  ?&gt;
  &lt;p&gt;Navigation: &lt;?php echo $_SESSION['counter'] ?&gt;&lt;/p&gt;
  </code></pre>
  
  <p>Varnish VCL configuration:</p>
  
  <pre><code>sub vcl_recv {
      set req.http.Surrogate-Capability = "abc=ESI/1.0";
  }
  
  sub vcl_fetch {
      if (beresp.http.Surrogate-Control ~ "ESI/1.0") {
          unset beresp.http.Surrogate-Control;
  
          set beresp.do_esi = true;
      }
  }
  
  sub vcl_deliver {
      if (obj.hits &gt; 0) {
          set resp.http.X-Cache = "HIT";
      } else {
          set resp.http.X-Cache = "MISS";
      }
  }
  </code></pre>
  
  <h2>Desired result</h2>
  
  <p>I'd like to see <code>index.php</code>/<code>footer.php</code> loaded from the cache, purged every 10/20 seconds, while <code>navigation.php</code> loaded directly from backend server. Of course the very first request to <code>index.php</code> cannot be cached as <code>Set-Cookie</code> header must be set, however <code>footer.php</code> could be loaded from cache from the very begining.</p>
  
  <hr>
  
  <p>How could I achieve that? I'm aware that presence of <code>Cookie</code> header in HTTP request causes cache-miss, but I can't simply delete it.</p>