Varnish cache works by creating a hash of the request consisting of method, url and for a site where you log in, that would also include the cookie you use for

Varnish cache works by creating a hash of the request consisting of method, url and for a site where you log in, that would also include the cookie you use for identification. Your proposed collision idea is very improbable but possible. There is actually a good article in the Varnish docs around hash collisions: https://varnish-cache.org/docs/4.1/phk/varnish_does_not_hash.html https://varnish-cache.org/docs/4.1/phk/varnish_does_not_hash... PS. Even though the article says "Varnish does not hash", I suggest everyone to keep reading until the end, when it turns out that they, in fact, do.