Nginx – Using nginx and/or varnish to cache server-generated 301 redirects

The reason pass is occurring is because the default VCL logic refuses to cache anything with an Authorization or Cookie in the request headers, and your request has a Cookie.

if (req.http.Authorization || req.http.Cookie) {
    /* Not cacheable by default */
    return (pass);
}

That default behavior is out of an abundance of caution, so that servers where different content is returned for a page in response to the user's session; you can modify this behavior in your vcl_recv. Implement yours as a copy of the default, but strip out the req.http.Cookie check:

if (req.http.Authorization) {
    /* Not cacheable by default */
    return (pass);
}

In terms of the redirect behavior, sounds like it's getting a 30x response, which is redirecting the client browser - can you provide the logs for one of those hits?

I'm afraid there is no way to do what you want. The problem is that your backend hands out the 301 response with the query parameter, and nginx has no methods to modify the HTTP response that is saved to the cache.

Your only option is to use the aid as additional cache key.