在NGINX SSL终结器上保留Google Analytics Cookie时使用Varnish Cache

Question

我正在为cPanel和一个特定网站使用Unixy Varnish插件，其所有子域都使用完整SSL + HTTP严格传输安全。

Nginx侦听非标准的ssl端口，将请求传递给Varnish，默认情况下会删除所有cookie。该请求最终由Apache提供。

该网站主要是静态HTML，带有WordPress子域，IPB安装，Piwik安装。

主域名只是静态页面，因此我想强制Varnish缓存它，因为没有任何涉及登录的内容，然后剥离不包括属于Google Analytics的Cookie。

目前，Google Analytics正在使用http://www.ga-script.org中的脚本，该脚本使用经典的跟踪代码js。我打算另外添加Universal Analytics代码，删除我的UA-XXXXXXX ID（仅限经典js）。

然后，我将在该帖子的最新评论中解析Analytics Cookie（如此处所述：http://www.dannytalk.com/read-google-analytics-cookie-script/），以及Universal Analytics的修复程序 - 因此我可以将结果值传递给Piwik和/或CRM系统。

我并非100％明白我需要做些什么来正确配置这种情况下的清漆，并希望其他人帮助解决这个问题。

Unixy提供的当前Varnish配置：

###################################################
# Copyright (c) UNIXY  -  http://www.unixy.net    #
# The leading truly fully managed server provider #
###################################################

include "/etc/varnish/cpanel.backend.vcl";

include "/etc/varnish/backends.vcl";

# mod_security rules
include "/etc/varnish/security.vcl";

sub vcl_recv {

# Use the default backend for all other requests
set req.backend = default;

# Setup the different backends logic
include "/etc/varnish/acllogic.vcl";

# Allow a grace period for offering "stale" data in case backend lags
set req.grace = 5m;

remove req.http.X-Forwarded-For;
set req.http.X-Forwarded-For = client.ip;

# cPanel URLs
include "/etc/varnish/cpanel.url.vcl";

# Properly handle different encoding types
if (req.http.Accept-Encoding) {
    if (req.url ~ "\.(jpg|jpeg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|swf|ico)$") {
        # No point in compressing these
        remove req.http.Accept-Encoding;
    } elsif (req.http.Accept-Encoding ~ "gzip") {
        set req.http.Accept-Encoding = "gzip";
    } elsif (req.http.Accept-Encoding ~ "deflate") {
        set req.http.Accept-Encoding = "deflate";
    } else {
        # unkown algorithm
        remove req.http.Accept-Encoding;
    }
}

# Set up disabled
include "/etc/varnish/disabled.vcl";

# Exclude upgrade, install, server-status, etc
include "/etc/varnish/known.exclude.vcl";

# Set up exceptions
include "/etc/varnish/url.exclude.vcl";

# Set up exceptions
include "/etc/varnish/debugurl.exclude.vcl";

# Set up exceptions
include "/etc/varnish/vhost.exclude.vcl";

# Set up vhost+url exceptions
include "/etc/varnish/vhosturl.exclude.vcl";

# Set up cPanel reseller exceptions
include "/etc/varnish/reseller.exclude.vcl";

# Restart rule for bfile recv
include "/etc/varnish/bigfile.recv.vcl";


if (req.request == "PURGE") {
        if (!client.ip ~ acl127_0_0_1) {error 405 "Not permitted";}
        return (lookup);
}

## Default request checks
if (req.request != "GET" &&
req.request != "HEAD" &&
req.request != "PUT" &&
req.request != "POST" &&
req.request != "TRACE" &&
req.request != "OPTIONS" &&
req.request != "DELETE") {
    return (pipe);
}

if (req.request != "GET" && req.request != "HEAD") {
    return (pass);
}

## Modified from default to allow caching if cookies are set, but not http auth
if (req.http.Authorization) {
    return (pass);
}

include "/etc/varnish/versioning.static.vcl";

## Remove has_js and Google Analytics cookies.
set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|has_js)=[^;]*", "");

set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");

if (req.http.Cookie ~ "^\s*$") {
    unset req.http.Cookie;
}

include "/etc/varnish/slashdot.recv.vcl";

# Cache things with these extensions
if (req.url ~ "\.(js|css|jpg|jpeg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|swf|pdf)$" && ! (req.url ~ "\.(php)") ) {
    unset req.http.Cookie;
    return (lookup);
}

return (lookup);
}

sub vcl_fetch {

set beresp.ttl = 40s;
set beresp.http.Server = " - Web acceleration by http://www.unixy.net/varnish ";

# Turn off Varnish gzip processing
include "/etc/varnish/gzip.off.vcl";

# Grace to allow varnish to serve content if backend is lagged
set beresp.grace = 5m;

# Restart rule bfile for fetch
include "/etc/varnish/bigfile.fetch.vcl";

# These status codes should always pass through and never cache.
if (beresp.status == 503 || beresp.status == 500) {
    set beresp.http.X-Cacheable = "NO: beresp.status";
    set beresp.http.X-Cacheable-status = beresp.status;
    return (hit_for_pass);
}

if (beresp.status == 404) {
    set beresp.http.magicmarker = "1";
    set beresp.http.X-Cacheable = "YES";
    set beresp.ttl = 20s;
    return (deliver);
}

/* Remove Expires from backend, it's not long enough */    
unset beresp.http.expires;

if (req.url ~ "\.(js|css|jpg|jpeg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|swf|pdf|ico)$" && ! (req.url ~ "\.(php)") ) {
    unset beresp.http.set-cookie;
    include "/etc/varnish/static.ttl.vcl";
}
include "/etc/varnish/slashdot.fetch.vcl"; 
else {
    include "/etc/varnish/dynamic.ttl.vcl";
}

/* marker for vcl_deliver to reset Age: */
set beresp.http.magicmarker = "1";

# All tests passed, therefore item is cacheable
set beresp.http.X-Cacheable = "YES";

return (deliver);
}

sub vcl_deliver {

  # From http://varnish-cache.org/wiki/VCLExampleLongerCaching
  if (resp.http.magicmarker) {
     /* Remove the magic marker */
     unset resp.http.magicmarker;

     /* By definition we have a fresh object */
     set resp.http.age = "0";
   }
   set resp.http.Location = regsub(resp.http.Location, ":[0-9]+", "");

   #add cache hit data
   if (obj.hits > 0) {
     #if hit add hit count
     set resp.http.X-Cache = "HIT";
     set resp.http.X-Cache-Hits = obj.hits;
   }
else {
     set resp.http.X-Cache = "MISS";
   }

}

sub vcl_error {

if (obj.status == 503 && req.restarts < 5) {
set obj.http.X-Restarts = req.restarts;
return (restart);
}

}

# Added to let users force refresh
sub vcl_hit {

if (obj.ttl < 1s) {
    return (pass);
}

if (req.http.Cache-Control ~ "no-cache") {
# Ignore requests via proxy caches,  IE users and badly behaved crawlers
# like msnbot that send no-cache with every request.
if (! (req.http.Via || req.http.User-Agent ~ "bot|MSIE|HostTracker")) {
    set obj.ttl = 0s;
    return (restart);
} 
}

return (deliver);

}

sub vcl_hash {

    hash_data(req.http.cookie);
}

Answer 1

您只需从请求中删除GA Cookie，您的后端就不会使用它们。

您可以删除除admin以外的所有Cookie

if ( !( req.url ~ ^/admin/) ) {
  unset req.http.Cookie;
}

或者丢弃所有以下划线开头的Cookie：

// Remove has_js and Google Analytics __* cookies.
set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(_[_a-z]+|has_js)=[^;]*", "");
// Remove a ";" prefix, if present.
set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");

https://www.varnish-cache.org/docs/4.0/users-guide/increasing-your-hitrate.html