Persistent login with reverse proxy (Varnish cache)

Hmm... I am using Varnish + Persistent Login (not Pressflow though). I noticed that PL was not working, and tried your fix, but it doesn't work- I am not logged back in automatically when I return to the site. Oddly, I am sometimes automatically logged in after visiting a second page on the site. Here is my VCL file, with your fix- can you help troubleshoot? I'm still a little green when it comes to Varnish.

sub vcl_recv {
  remove req.http.X-Forwarded-For;
  set req.http.X-Forwarded-For = client.ip;

  // from https://wiki.fourkitchens.com/display/PF/Configure+Varnish+for+Pressflow?focusedCommentId=13828160
  // Remove has_js, Google Analytics __* and Drupal.toolbar.collapsed cookies.
  set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|has_js|Drupal.toolbar.collapsed)=[^;]*", "");

  // Work with Persistent Login
  set req.http.Cookie = regsuball(req.http.Cookie, ";(SESS[a-z0-9]+|NO_CACHE|PERSISTENT_LOGIN_[a-zA-Z0-9]+)=", "; \1=");

  // Remove a ";" prefix, if present.
  set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");

  // Remove empty cookies.
  if (req.http.Cookie ~ "^\s*$") {
    unset req.http.Cookie;
  }

  // Skip the Varnish cache for install, update, and cron
  if (req.url ~ "install.php|update.php|cron.php") {
    return (pass);
  }

  // No varnish for install, update, or cron
  if (req.url ~ "install\.php|update\.php|cron\.php") {
    return (pass);
  }

  if (req.url ~ "\.(ogg|avi|mp4|m4v|mov|mpeg|wmv)$") {
    return (pipe);
  }

  # Force lookup if the request is a no-cache request from the client.
  # This fixes a weird bug of not being able to log out of Drupal
        if (req.http.Cache-Control ~ "no-cache")
           {purge_url(req.url);}

  // fix compression per http://www.varnish-cache.org/trac/wiki/FAQ/Compression
  if (req.http.Accept-Encoding) {
    if (req.url ~ "\.(jpg|png|gif|gz|tgz|bz2|tbz|mp3|ogg|avi|mp4|m4v|mov|mpeg|wmv)$") {
        # No point in compressing these
        remove req.http.Accept-Encoding;
    } elsif (req.http.Accept-Encoding ~ "gzip") {
        set req.http.Accept-Encoding = "gzip";
    } elsif (req.http.Accept-Encoding ~ "deflate" && req.http.user-agent !~ "MSIE") {
        set req.http.Accept-Encoding = "deflate";
    } else {
        # unkown algorithm
        remove req.http.Accept-Encoding;
    }
  }
  if (req.request == "GET" && req.http.Cookie !~ "DRUPAL_VARNISH") {
    return(lookup);
  }
}

sub vcl_hash {
  if (req.http.Cookie) {
    set req.hash += req.http.Cookie;
  }
}

sub vcl_fetch {
  if (beresp.http.Cache-Control ~ "(private|no-cache|no-store)") {
    return(pass);
  }
}

Ah, I think I've figured it out... it has to do with the cookie blacklisting vs whitelisting approaches that they discuss. What a useful article! I wish that had been around when I first set up Varnish... :)

Okay, I solved that particular part of the issue- I too prefer the Lullabot approach now- but here's another issue that you are probably affected by, whether you realize it or not :) In order for Varnish to properly serve nodes (not just images, js, css, etc...), I've heard that you need to set page_cache_invoke_hooks = FALSE. However, if you do this, Persistent Login will not work, since it never has a chance to act.

Have you already considered this and found a way around it?

It is somewhat unique to D7. I don't know if it applies to D6 / Pressflow.

Is there any update on this issue ?

FYI, page_cache_invoke_hooks (in settings.php) only applies to D7 and allows for Varnish caching.

$conf['page_cache_invoke_hooks'] = FALSE;

I can confirm that Persistent Login (1.0-beta1) works on Pantheon (which has Varnish enabled by default). All you have to do is rename the cookie at /admin/config/system/persistent_login to SESSpersist or something similar (SESS+ lowercase string) as per Pantheon policies.

I'm using the 7x branch on Pantheon and everyone works fine with that, too. The session cookie info for Pantheon's Varnish settings are at http://helpdesk.getpantheon.com/customer/portal/articles/425726 down at the bottom.

I've added a note to the readme on adding the persistent login cookie to reverse proxy configuration

The link which explains Pantheon's cookie policy, and the "SESS" prefix is here:
https://pantheon.io/docs/caching-advanced-topics/

Edit: after testing, I can confirm that the "SESS" prefix *doesn't work* to fix this hole on Pantheon.

Any one know what is the config to be done for Drupal 8 ?

There is varnish cache on my server, and sometimes a cache version of pages are being served to my users.

When they refresh the page, they are login automatically.

For example as Admin, i check the remember me box and login.

I browse the website, and closes my browser.

I reopen my browser and visits the website. I am not login, if i access the admin page.
I am login automatically.
Isn't this a security risk ?

I'm using latest version of persistent login.