I've deployed a couple of Magento installs (2.3) on dedicated servers, with Varnish.

Out of the box, everything seems to be ok, but it seems once we developers onto the installations to add themes, change settings etc, Magento starts sending set-cookie headers on every request, which in turn is causing Varnish misses on every request.

It's actually setting the cookiet wice, and there is also a form-key cookie which is being set on each page load also.

I've noticed this behaviour on two installations now, both unrelated to each other and not using the same themes.

Headers are as below, real domain obfuscated.

set-cookie: PHPSESSID=4k1dcb8sm6ha3clucobol0kc3i; expires=Wed, 03-Apr-2019 12:00:06 GMT; Max-Age=3600; path=/shop; domain=xxxxxx.com; HttpOnly

set-cookie: PHPSESSID=4k1dcb8sm6ha3clucobol0kc3i; expires=Wed, 03-Apr-2019 12:00:06 GMT; Max-Age=3600; path=/shop; domain=xxxxxx.com; HttpOnly

set-cookie: form_key=o0u78GIjo9s9ammV; expires=Wed, 03-Apr-2019 12:00:06 GMT; Max-Age=3600; path=/shop; domain=xxxxxx.com

Can anyone confirm if this is expected behaviour, or where it may be coming from?

Edit - on further reading it appears that form_key is being set for CSRF protection purposes, i'm assuming themes which have inline carts or forms are setting this. I'd be interested in known if/how anyone is managing Varnish caching in this situation?