In general everything works fine using Varnish enable w/ Turpentine extension. All of the standard areas of the admin section work as expected.

The issue comes when I navigate to an extension in the admin that does not use the standard /index.php/admin. Navigating to these extension I get logged out of the admin section.

We use a number of extensions that use these sort of urls. All have the same issue. It goes away when disabling Varnish or add the Varnish bypass cookie.

I have updated the URL Black list setting in Magento to reflect these urls. But the issue persists.


The issue is also intermittent. Many times, after fiddling with the settings, these extensions are again accessible, but given a day or so, the issue returns.

Other relevant info:

Hosted at https://magemojo.com/
Using nginx
php 5.6 fpm
Magento with all security updates
  • To be honest, it sounds more like the SUPEE-6788 admin router patch. But without more info it's hard to come up with a good solution magento.com/security/patches/supee-6788-technical-details Commented Feb 27, 2016 at 18:02
  • 1
    magemojo has its own 24/7 magento expert support.. do you have problems with their support?? i think it is not good to skip them ....
    – MagenX
    Commented Feb 27, 2016 at 18:09
  • @SanderMangel That seems like it could be related. The urls are accessible when I disable Varnish though. Any suggestions how to proceed or what other info would be useful? Commented Feb 28, 2016 at 5:56
  • @MagenX While I have not asked them with this specific issue, in they past I have been told they do not support setting up the specifics of Varnish configuration. Commented Feb 28, 2016 at 5:58
  • @DavidHayes to be honest, I suck at Varnish so I don't think I can be of a lot of help Commented Feb 28, 2016 at 10:24

2 Answers 2


I'm one of the co-founders here at MageMojo and would be happy to help.

Try changing your turpentine crawler ip from to anything else. The reason is nginx is forwarding from and turpentine will match regular requests:

if (client.ip ~ crawler_acl || req.http.User-Agent ~ "^(?:ApacheBench/. *|.*Googlebot.*|JoeDog/.*Siege.*|magespeedtest\.com|Nexcessnet_Turpentine/.*​)$") {

Which triggers:

set req.http.Cookie = "frontend=crawler-session";

The crawler will still match on user agent and work. You just need to change the turpentine admin crawler ip to anything other than so it doesn't match normal requests forwarded from nginx.

  • You're welcome. Feel free to open a support request anytime even if you think your question is out of our support scope. Magento is all we host so we have a lot of experience to draw from that might be helpful with your issue. Commented Mar 1, 2016 at 18:52

The issue is also intermittent. Many times, after fiddling with the settings, these extensions are again accessible, but given a day or so, the issue returns.

The blacklist settings would be the ideal way to handle this scenario. This sounds quite strange - it sounds like your varnish settings (including the blacklist) are getting re-applied when you make a change, and then changed again later. Is it possible that Varnish is getting restarted somehow and losing it's settings? Have you set it up so that the VCL generated by Turpentine is used by Varnish when it restarts?

It's also a very good idea to check the crawler IP issue in MageMojo's answer.

If you're still having problems after trying these feel free to open an issue over on the github and post the VCL that Turpentine is generating and we'll try to help your more.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.