Hello Ibexa team,

The current custom Fastly VCL configuration prevents users from easily adding exceptions and special cases in VCL snippets. At the moment, adding some basic auth configuration, another backend in some conditions or even a pass on specific paths is not possible without manually editing the ez_main.vcl file, as the #FASTLY recv include is too low.

My suggestion is to move it from after a few returns (and the call ez_user_context_hash;) to just before the first if (req.http.Authenticate || req.http.Authorization) check (line 25 , if the VCL file I'm looking at is recent enough); this would allow customers to easily change their configuration. This change has been tested (with the customer's agreement, of course) on a big production service; this change has been activated there on 2021-06-24, without any issue noticed by the customer ever since.

This allows for more flexibility, but also for more peace of mind for when the customer needs to upgrade to another Ibexa VCL version; if the custom configuration can remain in snippets, it is easier to just replace the custom VCL with a new version.

Thank you,

Lucas