Does Varnish-devicedetect cookie based User-agent override require vary: cookie for correct browser caching?

Question

varnish-devicedetect lets me return different responses based on User-agent:

...
elsif (req.http.User-Agent ~ "(?i)ipad")        { set req.http.X-UA-Device = "tablet-ipad"; }
elsif (req.http.User-Agent ~ "(?i)ip(hone|od)") { set req.http.X-UA-Device = "mobile-iphone"; }
...

and lets users opt into a different device experience by setting a cookie:

if (req.http.Cookie ~ "(?i)X-UA-Device-force") {
  ...
}

Do I need to add Vary: Cookie to get correct client caching behavior?

For example:

1. I set only Vary: User-agent
2. A user browses to example.com/beep
3. They opt into the desktop experience, setting X-UA-Device-force: pc.
4. They reload example.com/beep.
   Will their browser use the cached mobile version, since only Cookies, not User-agent changed?

Answer 1

Yes, you need to set a Vary: Cookie header to get the correct behaviour since different cookies would retrive different output.

You'll need also to take care of the cookie on vcl_recv setting the appropriate X-UA-Device in order to hash items correctly in varnish.

Answer 2

If you vary cookie, then you might as well through caching out the window since most users will have different cookies (especially so if you have any analytics on your site) so you will have a low hit rate and multiple copies of the same data in your cache.

Rather than vary cookie, do a hash on the specific cookie value like so:

if (req.http.cookie ~ "(?i)X-UA-Device-force" ) {
  hash_data("deviceforce");
} else {
  hash_data("nodeviceforce");
}