title: Varnish 6's VCL not stripping out cookies as expected
body: <p>I'm having trouble stripping out cookies I don't want using Varnish (v6.0.8). I <em>thought</em> this was working, but I think instead it was the URL-based filtering that was working and I just hadn't noticed because it overlapped.</p>
  <p>The relevant section of my configuration file is as follows:</p>
  <pre><code>sub vcl_recv {
  
      set req.http.X-Forwarded-For = regsub(req.http.X-Forwarded-For,&quot;^([^,]+)(,[^,]+)*&quot;,&quot;\1&quot;);
  
      if (req.method == &quot;PURGE&quot;) {
      if (!client.ip ~ purge) {
      return (synth(405, &quot;This IP is not allowed to send PURGE requests.&quot;));
  }
      if (req.http.X-Purge-Method == &quot;regex&quot;) {
      ban(&quot;obj.http.x-url ~ &quot; + req.url + &quot; &amp;&amp; obj.http.x-host ~ &quot; + req.http.host);
      return (synth(200, &quot;Banned&quot;));
  }
      return (purge);
  }
      if (req.url ~ &quot;(wp-admin|post\.php|edit\.php|wp-login|wp-json)&quot;) {
      return(pass);
  }
      if (req.http.Cookie ~ &quot;wordpress_logged_in_|resetpass|wp-postpass_&quot;) {
      return(pass);
  }
  
  # Remove cookies
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;comment_author_[a-zA-Z0-9_]+&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;has_js=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;wp-settings-1=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;wp-settings-time-1=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;wordpress_test_cookie=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;PHPSESSID=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;__utm.=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;_ga=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;utmctr=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;utmcmd.=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;utmccn.=[^;]+(; )?&quot;, &quot;&quot;);
      set req.http.Cookie = regsuball(req.http.Cookie, &quot;wp_woocommerce_session_[^;]+(;)&quot;, &quot;&quot;);
  # Remove proxy header (see https://httpoxy.org/#mitigate-varnish)
      unset req.http.proxy;
  # Normalize query arguments (sort alphabetically)
      set req.url = std.querysort(req.url);
  # Strip trailing ? if it exists
      if (req.url ~ &quot;\?$&quot;) {
      set req.url = regsub(req.url, &quot;\?$&quot;, &quot;&quot;);
  }
  # Limit requests to the following types
      if (req.method !~ &quot;^GET|HEAD|PUT|POST|TRACE|OPTIONS|PATCH|DELETE$&quot;) {
      return (pipe);
  }
  # Only cache GET or HEAD requests to ensure that POST requests are always passed through, along with their cookies
      if (req.method != &quot;GET&quot; &amp;&amp; req.method != &quot;HEAD&quot;) {
      return (pass);
  }
  # Don't cache AJAX requests
      if (req.http.X-Requested-With == &quot;XMLHttpRequest&quot;) {
      return(pass);
  }
  # Don't cache images and PDFs
      if (req.url ~ &quot;\.(gif|jpg|jpeg|bmp|png|pdf)$&quot;) {
      return(pass);
  }
  # Don't cache large files (zip, audio, video, etc.)
      if (req.url ~ &quot;^[^?]*\.(7z|avi|bz2|flac|flv|gz|mka|mkv|mov|mp3|mp4|mpeg|mpg|ogg|ogm|opus|rar|tar|tgz|tbz|txz|wav|webm|wmv|xz|zip)(\?.*)?$&quot;) {
      return (pipe);
  }
  # Add support for ESI
      if (req.http.Authorization) {
      return (pass);
  }
  # Wordpress: don't cache WooCommerce pages
      if (req.url ~ &quot;(cart|my-account|checkout|addons|checkouts|product)&quot;) {
      return (pass);
  }
      if ( req.url ~ &quot;(\?|&amp;)add-to-cart=&quot; ) {
      return (pass);
  }
      if ( req.url ~ &quot;(\?|&amp;)wc-ajax=&quot; ) {
      return (pass);
  }
  # Wordpress: don't cache associated requests if the referer is a WooCommerce page
      if (req.http.referer ~ &quot;(cart|my-account|checkout|addons|checkouts|product)&quot;) {
      return(pass);
  }
  # Are there cookies left with only spaces or that are empty?
      if (req.http.cookie ~ &quot;^\s*$&quot;) {
      unset req.http.cookie;
  }
  # Remove all cookies to enable caching
      unset req.http.Cookie;
      return (hash);
  }
  </code></pre>
  <p>As far as I understand it, the regexes in the # Remove cookies section, should be stripping out those cookies. But they don't. What am I doing wrong?</p>
  <p>Thanks!</p>
  <p><strong>UPDATE</strong>: Here is the output code from Varnish. I think it's not executing, but I can't see why. I've tried moving it up to the top of the <code>sub vcl_recv</code> section, but it makes no difference:</p>
  <pre><code>*   &lt;&lt; Request  &gt;&gt; 3007535
  -   Begin          req 3007534 rxreq
  -   Timestamp      Start: 1638408710.214334 0.000000 0.000000
  -   Timestamp      Req: 1638408710.214334 0.000000 0.000000
  -   ReqStart       &lt;REDACTED IP&gt; a1
  -   ReqMethod      HEAD
  -   ReqURL         /example-page/
  -   ReqProtocol    HTTP/1.1
  -   ReqHeader      host: example.com
  -   ReqHeader      user-agent: curl/7.77.0
  -   ReqHeader      accept: */*
  -   ReqHeader      x-forwarded-port: 443
  -   ReqHeader      x-forwarded-proto: https
  -   ReqHeader      x-forwarded-for: &lt;REDACTED IP&gt;
  -   ReqUnset       x-forwarded-for: &lt;REDACTED IP&gt;
  -   ReqHeader      X-Forwarded-For: &lt;REDACTED IP&gt;, &lt;REDACTED IP&gt;
  -   VCL_call       RECV
  -   ReqUnset       X-Forwarded-For: &lt;REDACTED IP&gt;, &lt;REDACTED IP&gt;
  -   ReqHeader      X-Forwarded-For: &lt;REDACTED IP&gt;
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqUnset       Cookie:
  -   ReqHeader      Cookie:
  -   ReqURL         /example-page/
  -   ReqUnset       Cookie:
  -   VCL_return     hash
  -   VCL_call       HASH
  -   ReqHeader      newUrl: /example-page/
  -   VCL_return     lookup
  -   HitMiss        3617921 98.252548
  -   VCL_call       MISS
  -   VCL_return     fetch
  -   Link           bereq 3007536 fetch
  -   Timestamp      Fetch: 1638408711.615163 1.400829 1.400829
  -   RespProtocol   HTTP/1.1
  -   RespStatus     200
  -   RespReason     OK
  -   RespHeader     Server: nginx
  -   RespHeader     Date: Thu, 02 Dec 2021 01:31:51 GMT
  -   RespHeader     Content-Type: text/html; charset=UTF-8
  -   RespHeader     Vary: Accept-Encoding
  -   RespHeader     Set-Cookie: wp_woocommerce_session_7006ef9ea65e2d5e1a330b658a34667c=e005d432498b0dc461295d782d2bc59c%7C%7C1638581510%7C%7C1638577910%7C%7C13a8cdc105250d841e0fef56a1255d03; expires=Sat, 04-Dec-2021 01:31:50 GMT; Max-Age=172800; path=/; secure; HttpOnly
  -   RespHeader     Set-Cookie: wl_current_page_id=20387; expires=Thu, 02-Dec-2021 02:31:50 GMT; Max-Age=3600; path=/
  -   RespHeader     Link: &lt;https://example.com/wp-json/&gt;; rel=&quot;https://api.w.org/&quot;
  -   RespHeader     Link: &lt;https://example.com/wp-json/wp/v2/posts/20387&gt;; rel=&quot;alternate&quot;; type=&quot;application/json&quot;
  -   RespHeader     Link: &lt;https://example.com/?p=20387&gt;; rel=shortlink
  -   RespHeader     X-Content-Type-Options: nosniff
  -   RespHeader     X-XSS-Protection: 1; mode=block
  -   RespHeader     X-UA-Compatible: IE=Edge
  -   RespHeader     Content-Security-Policy: frame-ancestors 'self'
  -   RespHeader     X-Frame-Options: SAMEORIGIN
  -   RespHeader     Content-Encoding: gzip
  -   RespHeader     x-url: /example-page/
  -   RespHeader     x-host: example.com
  -   RespHeader     X-Varnish: 3007535
  -   RespHeader     Age: 0
  -   RespHeader     Via: 1.1 varnish (Varnish/6.0)
  -   VCL_call       DELIVER
  -   RespUnset      x-url: /example-page/
  -   RespUnset      x-host: example.com
  -   RespHeader     X-Cache: MISS
  -   RespHeader     X-Cache-Hits: 0
  -   RespUnset      X-Varnish: 3007535
  -   RespUnset      Via: 1.1 varnish (Varnish/6.0)
  -   RespUnset      Server: nginx
  -   VCL_return     deliver
  -   Timestamp      Process: 1638408711.615227 1.400893 0.000064
  -   RespUnset      Content-Encoding: gzip
  -   RespHeader     Accept-Ranges: bytes
  -   RespHeader     Connection: keep-alive
  -   Gzip           U D - 0 0 0 0 0
  -   Timestamp      Resp: 1638408711.615536 1.401202 0.000309
  -   ReqAcct        239 0 239 947 0 947
  -   End
  **  &lt;&lt; BeReq    &gt;&gt; 3007536
  --  Begin          bereq 3007535 fetch
  --  VCL_use        reload_20211202_013110_5534
  --  Timestamp      Start: 1638408710.214561 0.000000 0.000000
  --  BereqMethod    HEAD
  --  BereqURL       /example-page/
  --  BereqProtocol  HTTP/1.1
  --  BereqHeader    host: example.com
  --  BereqHeader    user-agent: curl/7.77.0
  --  BereqHeader    accept: */*
  --  BereqHeader    x-forwarded-port: 443
  --  BereqHeader    x-forwarded-proto: https
  --  BereqHeader    X-Forwarded-For: &lt;REDACTED IP&gt;
  --  BereqHeader    newUrl: /example-page/
  --  BereqMethod    GET
  --  BereqHeader    Accept-Encoding: gzip
  --  BereqHeader    X-Varnish: 3007536
  --  VCL_call       BACKEND_FETCH
  --  VCL_return     fetch
  --  BackendOpen    66 reload_20211202_013110_5534.planet-a 10.0.55.20 80 10.0.55.10 43206
  --  BackendStart   &lt;REDACTED&gt; 80
  --  Timestamp      Bereq: 1638408710.214709 0.000147 0.000147
  --  Timestamp      Beresp: 1638408711.614969 1.400408 1.400261
  --  BerespProtocol HTTP/1.1
  --  BerespStatus   200
  --  BerespReason   OK
  --  BerespHeader   Server: nginx
  --  BerespHeader   Date: Thu, 02 Dec 2021 01:31:51 GMT
  --  BerespHeader   Content-Type: text/html; charset=UTF-8
  --  BerespHeader   Transfer-Encoding: chunked
  --  BerespHeader   Connection: keep-alive
  --  BerespHeader   Vary: Accept-Encoding
  --  BerespHeader   Set-Cookie: wp_woocommerce_session_7006ef9ea65e2d5e1a330b658a34667c=e005d432498b0dc461295d782d2bc59c%7C%7C1638581510%7C%7C1638577910%7C%7C13a8cdc105250d841e0fef56a1255d03; expires=Sat, 04-Dec-2021 01:31:50 GMT; Max-Age=172800; path=/; secure; HttpOnly
  --  BerespHeader   Set-Cookie: wl_current_page_id=20387; expires=Thu, 02-Dec-2021 02:31:50 GMT; Max-Age=3600; path=/
  --  BerespHeader   Link: &lt;https://example.com/wp-json/&gt;; rel=&quot;https://api.w.org/&quot;
  --  BerespHeader   Link: &lt;https://example.com/wp-json/wp/v2/posts/20387&gt;; rel=&quot;alternate&quot;; type=&quot;application/json&quot;
  --  BerespHeader   Link: &lt;https://example.com/?p=20387&gt;; rel=shortlink
  --  BerespHeader   X-Content-Type-Options: nosniff
  --  BerespHeader   X-XSS-Protection: 1; mode=block
  --  BerespHeader   X-UA-Compatible: IE=Edge
  --  BerespHeader   Content-Security-Policy: frame-ancestors 'self'
  --  BerespHeader   X-Frame-Options: SAMEORIGIN
  --  BerespHeader   Content-Encoding: gzip
  --  TTL            RFC 120 10 0 1638408712 1638408712 1638408711 0 0 cacheable
  --  VCL_call       BACKEND_RESPONSE
  --  BerespHeader   x-url: /example-page/
  --  BerespHeader   x-host: example.com
  --  TTL            VCL 2592000 10 0 1638408712 cacheable
  --  TTL            VCL 2592000 86400 0 1638408712 cacheable
  --  TTL            VCL 120 86400 0 1638408712 cacheable
  --  TTL            VCL 120 86400 0 1638408712 uncacheable
  --  VCL_return     deliver
  --  Storage        malloc Transient
  --  Fetch_Body     2 chunked stream
  --  Debug          &quot;Fetch: Pass delivery abandoned%00&quot;
  --  Gzip           u F - 13522 65516 80 80 0
  --  BackendClose   66 reload_20211202_013110_5534.planet-a
  --  Timestamp      BerespBody: 1638408711.616261 1.401700 0.001292
  --  Length         13522
  --  BereqAcct      347 0 347 952 13522 14474
  --  End
  </code></pre>