If Varnish strips cookies from all static resources, then simply embedding an <img> tag that points to a nonexisting image on the page should be able to destroy your session too, no? Sounds like a very dangerous setup.
Not a dangerous setup as much as a misconfigured one with dangerous side effects.
The problem is easily resolved by having Apache respond with a 404 to any requests for non-existant static resources. Which is of course what it should be doing in the first place.
Comments
If Varnish strips cookies from all static resources, then simply embedding an <img> tag that points to a nonexisting image on the page should be able to destroy your session too, no? Sounds like a very dangerous setup.
Not a dangerous setup as much as a misconfigured one with dangerous side effects.
The problem is easily resolved by having Apache respond with a 404 to any requests for non-existant static resources. Which is of course what it should be doing in the first place.
If you have bad links, and this PHP scheme, then Google will probably flag you for duplicate content issues too.