[Shish2k]

In addition to other answers - it depends what the cookies are for -- if your users only get a session cookie after logging in (before that they only have front-end cookies for things like google analytics / remembering which widget on the site is currently active / etc) then you can ignore front-end cookies, thus successfully caching for all not-logged-in users:

    if(req.http.Cookie) {
        # ignore front-end cookies (prefixed with "ui-")
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(ui-[a-z-]+)=[^;]*", "");
        # ignore google cookies
        set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(__[a-z]+|has_js)=[^;]*", "");
        # Remove a ";" prefix, if present.
        set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
        # Remove empty cookies.
        if (req.http.Cookie ~ "^\s*$") {
            unset req.http.Cookie;
        }
    }

In my read-mostly use-case, this allows ~90% of site traffic to be served by varnish, even though the site is totally dynamic (for not-logged-in users, all the state that we care about is in the GET parameters).

[kawsper]

This is the way to do it.

Another way of doing it is to exclude all cookies, and only care about session-cookies.