problem with password protected posts with nginx

This snippet:

/*
  // Cache any dynamic content
  if (req.url !~ "wp-(login|admin|signup)" && req.url !~ "preview" || req.url ~ "admin-ajax.php"){
    std.log("Request is not for login, admin, preview, sign up or admin-ajax so don't cache it");
      if (req.http.Cookie !~ "wordpress_logged_in "){
        std.log("User is not logged in");
        if (req.http.Cookie !~ "wp-postpass"){
          std.log("Post is not password protected");
          unset req.http.cookie;
          return(lookup);
        }
      }
    }
  }
  */
}

Taken from here:

https://github.com/JohnMcLear/Wordpress-Varnish-VCL/blob/master/default.vcl

may be of use to you.

I’m assuming you flip flop between Apache/Nginx both of which are fronted by Varnish? And WordPress 3.51? Really?

I only manage the server (apache, nginx/ varnish) and make it work for the team that does WordPress… so I don’t have much control over the WordPress version.

We are migrating from apache to nginx and just cut things over yesterday. We still need to use apache to process our shibboleth logins until we can re-engineer that to work with nginx. To do this I pass all requests to wp-login.php to apache which is listening to an alternate port and not accessible through the firewall. Its a cludge but it works.

I thought everything was working until I got a call about users not being able to access password protected pages… Didn’t know we had any until then… or how they worked

After much digging into password protected pages and using firebug I found that I was not getting wp-postpass cookies so I removed this from the vcl_fetch section :

# only allow cookies to be set if we're in admin area
    if( beresp.http.Set-Cookie && req.url !~ "^/wp-(login|admin)"){
            unset beresp.http.Set-Cookie;
    }

which I know kills the caching for right now… I will go into dev now and look at that link you provided but for now I am no longer in firefighting mode.

thanks

just incase anyone finds this with the same issue I also had to add this to vcl_recv

# password protected pages miss cache
    if( req.http.Cookie ~ "wp-postpass_" ){
            return (pass);
    }