Full page cache (FastCGI or other) configurations with CSRF compatibility

Noma

Member
Licensed customer
There seems to some conversations about full page caching here but it's mostly years old and the solutions don't seem to work anymore. Has anyone been able to implement a full page caching with FastCGI, Varnish or any other similar tool for non-logged-in users so that it wouldn't break the CSRF handling? All the AJAX requests including the login form are failing with just basic cache configs.

It would save a lot of processing power and server loads if this could be implemented. Thanks in advance if someone has the solution!
 
Isn't it enough to just skip caching if the cookie "xf_session" is present and only cache GET requests?

It would lead to problems with the CSRF token being cached as well and then all the AJAX features would break, including the login modal.
 
Back
Top Bottom