Security issue with default Varnish configuration

[madalinoprea]

Hi Fabrizio,

Default Varnish configuration allows any client to purge the entire Varnish cache. This might not be desirable, maybe would be better to bypass cache only for this request.

{{{
curl -v -H "Cache-Control:no-cache" http://varnish.demo.aoemedia.de/*
}}}

After you run this, check X-Cache header for these pages http://varnish.demo.aoemedia.de/electronics.html and http://varnish.demo.aoemedia.de/

Cheers,
Mario

[fbrnc]

Hi Mario,

thank you for you feedback and sorry for the late response.

You're perfectly right! The bundled vcl file was more a template for copying that I provided. Of course on a production environment you would not want everyone to purge your cache. If added a acl that of course needs to be adapted to the specific IP addresses.

Bye, and have a nice day...

Fabrizio