Can we change part of the output in Varnish in each response - caching

Question

Let's say we want to provide a unique CSRF token for each response cached by Varnish.
Is there a way hook Varnish output so that we can change a specific part of the content programmatically?

Answer 1

Varnish Cache solution with ESI & vmod_digest
In the open source version of Varnish, you can use Edge Side Includes for this.
You can put the following place holder in your output:
<esi:include src="/csrf-token-esi" />
This ESI tag will be parsed by Varnish and the /csrf-token-esi endpoint can be intercepted by Varnish and changed.
Be sure to return a Surrogate-Control: Varnish=ESI/1.0 response header on the page that contains the ESI tag. This header will force Varnish to parse the ESI tag.
Via synthetic responses, we can change the response body of /csrf-token-esi.
Here's an example where we use vmod_digest to create an HMAC signature as the CSRF token:
vcl 4.1;
import digest;
backend default {
.host = "localhost";
.port = "8080";
}
sub vcl_recv {
set req.http.Surrogate-Capability = "Varnish=ESI/1.0";
if(req.url == "/csrf-token-esi") {
return(synth(777,digest.hmac_sha256("secret-key", now)));
}
}
sub vcl_backend_response {
if (beresp.http.Surrogate-Control ~ "ESI/1.0") {
unset beresp.http.Surrogate-Control;
set beresp.do_esi = true;
}
}
sub vcl_synth {
if(resp.status == 777) {
set resp.body = resp.reason;
set resp.http.csrf-token = resp.reason;
set resp.status = 200;
return(deliver);
}
}
FYI: you can download the vmod_digest source from https://github.com/varnish/libvmod-digest. You need to compile this from source or use another mechanism to create a unique value.
The value of the CSRF token is generated by the following line of code:
return(synth(777,digest.hmac_sha256("secret-key", now)));
The secret-key is the HMAC's signing key and now returns the current timestamp in Varnish which is the value that will be signed.
There are plenty of other ways to generate a CSRF token. vmod_digest also has other ways to generate unique output. Just remember that the 2nd argument of the synth() function is the response body and effectively the value of the CSRF token.
Varnish Enterprise solution with vmod_edgestash & vmod_crypto
In Varnish Enterprise all the necessary VMODs are packaged, so no need to compile them from source. The vmod_edgestash and vmod_crypto VMODs are enterprise VMODs.
The solution consists of adding a {{csrf}} placeholder in your response. The format of this placeholder is Mustache syntax and is parsed by vmod_edgestash.
Unlike the Varnish Cache solution, no extra roundtrips and request interception are required. Varnish Enterprise will cache the page that includes the placeholder and will customize the CSRF token upon delivery.
Here's the VCL code:
vcl 4.1;
import crypto;
import edgestash;
backend default {
.host = "localhost";
.port = "8080";
}
sub vcl_backend_response{
if (beresp.http.Content-Type ~ "html") {
edgestash.parse_response();
}
}
sub vcl_deliver {
if (edgestash.is_edgestash()) {
set req.http.csrf = crypto.hex_encode(crypto.urandom(16));
edgestash.add_json({"
{"csrf":""} + req.http.csrf + {""
}
"});
edgestash.execute();
}
}
In this case we're using crypto.hex_encode(crypto.urandom(16)) to generate a unique value. But again, you can use any function that vmod_crypto provides to generate this unique value.
See https://docs.varnish-software.com/varnish-cache-plus/vmods/edgestash/ for more information about vmod_edgestash and https://docs.varnish-software.com/varnish-cache-plus/vmods/total-encryption/ for more information about vmod_crypto.