Admin features viewable logged out

Here is some additional information:

This issue occurs on macOSX with Chrome, Safari, and Arc. Interestingly, it does not manifest in Firefox. Firefox behaves as expected. I'm uncertain if this detail helps in identifying the underlying issue.

Adding the following to the default.vcl resolves the issue:

sub vcl_hash {

    # ... (existing code)

    /** If Bin is set - add it to hash data for this page */
    hash_data(req.http.X-Bin);

    return (lookup);
}

# Respond to incoming requests.
sub vcl_recv {

    # ... (existing code)

 # Do not cache if the user is logged in as an admin.
    if (req.http.Cookie ~ "^(|.*; ?)S?SESS([a-z0-9]{32}=[^;]+)(;.*|)$" &&
        req.http.Cookie ~ "^(|.*; ?)ADVBIN=administrator(|;.*|)$") {
        set req.http.X-Bin = "role:administrator";
        set req.hash_always_miss = true; # Ensure a cache miss for admin requests
    }

  return (hash);
}

We have tested this on Arc, Chrome, FireFox, and Safari and it works as expected.

Perhaps we are doing something wrong initially. Would love some feedback!

After much testing this is what we ended up with:

sub vcl_backend_response {
  if (beresp.http.X-Authenticated-User == "true") {
    set beresp.ttl = 0s;
    set beresp.uncacheable = true;
    set beresp.http.Cache-Control = "no-cache, no-store, must-revalidate";
    set beresp.http.Pragma = "no-cache";
    set beresp.http.Expires = "0";
  } else {
    set beresp.http.Cache-Control = "public, max-age=120s";
    set beresp.ttl = 2m;
  }
  Default code as usual ...
}

This keeps admin/logged in completely uncached. Our main reason for this is to make sure the admin menu never shows logged out and also to make sure no data is lost with forms. Most of our clients prefer to roam their sites and edit as they go.