alphagov/pp-puppet — pull request #310 by robyoung (2014-03-27 13:41:40+00:00)
Title: Varnish caching

By default Varnish will not cache any requests with a Cookie or an
Authorization header. This change tells Varnish to lookup GET or HEAD
requests if the Authorization header is set.

This obviously raises the risk of sending a cached response to an
unauthorised client. This is mitigated by the backend app sending a Vary
header set to 'Authorized'.