<p><code>CraftSessionId</code> is just the <a href="https://secure.php.net/manual/en/function.session-set-cookie-params.php" rel="nofollow noreferrer">PHP session cookie</a> renamed, so you'll get it on every request that requires session, regardless if they are authenticated with Craft or not.</p>

<p>The Craft authentication cookie is a cookie with a 32 character randomly generated name.  i.e. <code>7afe5904f6b2a09ce620eca02e80328c</code>.</p>

CC BY-SA 3.0
2017-10-24T09:00:31.933Z
Thank you Brad! There is also another cookie ending with "username" i.e. `7afe5904f6b2a09ce620eca02e80328cusername`, I guess it's safe to use it too?
Jose Manosalvas
CC BY-SA 3.0
2017-10-25T23:56:38.403Z
Yeah, that's just for populating the username on the login page.  You can either allow it or set https://craftcms.com/docs/config-settings#rememberUsernameDuration to `false` to disable that feature.
Brad Bell
CC BY-SA 3.0
2017-10-18T17:36:38.200Z
2017-10-18T17:36:38.200Z
Brad Bell
<p>So the answer is to test the cookie for a name with username in it, and pass if it exists. You could also check for an exactly 32 digit alphanumeric cookie name I guess.</p>

<pre><code>if (
 req.http.Cookie ~ "username" # Craft sessions have the word username in them
)
{
    return (pass);
}`
</code></pre>

CC BY-SA 4.0
2018-07-22T12:56:11.037Z
2018-07-22T12:56:11.037Z
Richard Frank
<p>Is it possible to bypass the Varnish cache when the user is logged in? I've tried using the "CraftSessionId" cookie, but it seems that it is also set for non logged in users.</p>

<cache><cookies><varnish>
Bypass Varnish cache if user is logged in
# Bypass Varnish cache if user is logged in

(Asked by: username_0 on 2017-10-18)

Is it possible to bypass the Varnish cache when the user is logged in? I've tried using the "CraftSessionId" cookie, but it seems that it is also set for non logged in users.

**Tags:** cache, cookies, varnish


---

## 2 answers

### Answer by username_1 on 2017-10-18. Score: 0 | Accepted answer

`CraftSessionId` is just the [PHP session cookie](https://secure.php.net/manual/en/function.session-set-cookie-params.php) renamed, so you'll get it on every request that requires session, regardless if they are authenticated with Craft or not.

The Craft authentication cookie is a cookie with a 32 character randomly generated name. i.e. `7afe5904f6b2a09ce620eca02e80328c`.

> **Comments:**
> **username_0**: Thank you Brad! There is also another cookie ending with "username" i.e. `7afe5904f6b2a09ce620eca02e80328cusername`, I guess it's safe to use it too?  
> **username_1**: Yeah, that's just for populating the username on the login page.  You can either allow it or set https://craftcms.com/docs/config-settings#rememberUsernameDuration to `false` to disable that feature.  

---

### Answer by username_2 on 2018-07-22. Score: 1

So the answer is to test the cookie for a name with username in it, and pass if it exists. You could also check for an exactly 32 digit alphanumeric cookie name I guess.
if (
 req.http.Cookie ~ "username" # Craft sessions have the word username in them
)
{
    return (pass);
}`


---

