Cache on Varnish 4+ based on Cache Control header and not cookies

Storing objects in the cache

This should do the trick when it comes to respecting the Cache-Control header and disregarding the Set-Cookie header.

sub vcl_backend response {
   if(beresp.http.Cache-Control ~ "private|no-cache|no-store" || beresp.ttl <= 0s) {
      set beresp.uncacheable = true;
      set beresp.ttl = 120s
   }
   return (deliver);
}

This code will store objects in cache that have a Set-Cookie header unless a no-cache, no-store, max-age=0 or s-maxage=0 appears in the Cache-Control header.

It only differs slightly from the Varnish built-in VCL behavior for vcl_backend_response.

However, the Set-Cookie header will also be stored in the cache when that happens, which seems dangerous.

Maybe you'd want to strip off the Set-Cookie header then. Here's the code to conditionally remove Set-Cookie headers:

sub vcl_backend response {
   if(beresp.http.Cache-Control ~ "private|no-cache|no-store" || beresp.ttl <= 0s) {
      set beresp.uncacheable = true;
      set beresp.ttl = 120s
   } else {
      unset beresp.http.Set-Cookie
   }
   return (deliver);
}

Serving objects from the cache

We also need to define the caching behavior of incoming requests that have a Cookie request header.

Here's the code I'd use for that:

sub vcl_recv {
    if (req.method == "PRI") {
        /* This will never happen in properly formed traffic (see: RFC7540) */
        return (synth(405));
    }
    if (!req.http.host &&
      req.esi_level == 0 &&
      req.proto ~ "^(?i)HTTP/1.1") {
        /* In HTTP/1.1, Host is required. */
        return (synth(400));
    }
    if (req.method != "GET" &&
      req.method != "HEAD" &&
      req.method != "PUT" &&
      req.method != "POST" &&
      req.method != "TRACE" &&
      req.method != "OPTIONS" &&
      req.method != "DELETE" &&
      req.method != "PATCH") {
        /* Non-RFC2616 or CONNECT which is weird. */
        return (pipe);
    }

    if (req.method != "GET" && req.method != "HEAD") {
        /* We only deal with GET and HEAD by default */
        return (pass);
    }

    if (req.http.Authorization) {
        return (pass);
    }
    return (hash);
}

The only way this differs from the Varnish built-in VCL for vcl_recv is the fact that the req.http.Cookie check is removed.

There's a lot of extra code there to prevent caching from taking place for uncacheable request methods or in case an Authorization header is sent.

However, if you don't care about any of that, you could just as well use the following code:

sub vcl_recv { 
    if (req.method == "GET" || req.method == "HEAD") {   
        return(hash);
    }
}

This will serve everything from cache for cacheable request methods and uses built-in VCL behavior for all other cases. With the measures in place in vcl_backend_response the Cache-Control: private, no-cache, no-store header will ensure uncacheable responses never end up in the cache.

Varnish's built-in VCL behavior

It's important to understand that Varnish has a built-in VCL behavior. Here's a tutorial about the various aspects of this behavior: https://www.varnish-software.com/developers/tutorials/varnish-builtin-vcl.

VCL should only extend the behavior in situations where it has a detrimental effect on the hit rate or the flexibility of your application.

Please have a look at the tutorial to understand the impact of the VCL code I'm suggesting.

All-in-one VCL code:

Here's the all-in-one VCL code you can use to get the job done. You might want to tweak it a bit:

vcl 4.1;

backend default {
    .host = "localhost";
    .port = "8080";
}

sub vcl_recv { 
    if (req.method == "GET" || req.method == "HEAD") {   
        return(hash);
    }
}
sub vcl_backend response {
   if(beresp.http.Cache-Control ~ "private|no-cache|no-store" || beresp.ttl <= 0s) {
      set beresp.uncacheable = true;
      set beresp.ttl = 120s
   } else {
      unset beresp.http.Set-Cookie
   }
   return (deliver);
}