250

Will content requested over https still be cached by web browsers or do they consider this insecure behaviour? If this is the case is there anyway to tell them it's ok to cache?

slashnick
  • 26,167
  • 10
  • 55
  • 67
  • Yes browsers will cache content over HTTPS check this link http://neopatel.blogspot.com/2010/02/firefox3-and-caching-https-content.html – Kalpesh Patel Feb 09 '10 at 15:56
  • 1
    @KalpeshPatel, That depends on the **user** settings. Some have set caching to disabled for **all** HTTPS pages http://blogs.msdn.com/b/ieinternals/archive/2010/04/21/internet-explorer-may-bypass-cache-for-cross-domain-https-content.aspx – Pacerier Mar 15 '15 at 18:10

3 Answers3

193

As of 2010, all modern, current-ish browsers cache HTTPS content by default, unless explicitly told not to.

It is not required to set cache-control:public for this to happen.

Source: Chrome, IE, Firefox.

Glorfindel
  • 21,988
  • 13
  • 81
  • 109
MarkR
  • 62,604
  • 14
  • 116
  • 151
  • 6
    It appears then, that the general trend is towards allowing caching of HTTPS objects; this is normally a Good Thing, as developers should be telling the browser not to cache objects at all if they are privacy-sensitive, and allowing it to do so when they are not (e.g. images, css, which is very performance-benficial especially on HTTPS). Thanks for that. – MarkR Apr 22 '10 at 20:44
  • 2
    Is it RFC-compliant to auto cache HTTPS resources without `cache-control:public`? – Pacerier May 05 '14 at 15:22
  • @Pacerier browsers consider RFC literal "request for comments". most often RFCs change to reflect what is already on browsers. – gcb Oct 23 '14 at 23:17
136

By default web browsers should cache content over HTTPS the same as over HTTP, unless explicitly told otherwise via the HTTP Headers received.

This link is a good introduction to setting cache setting in HTTP headers.

is there anyway to tell them it's ok to cache?

This can be achieved by setting the max-age value in the Cache-Control header to a non-zero value, e.g.

Cache-Control: max-age=3600

will tell the browser that this page can be cached for 3600 seconds (1 hour)

vaibhaw
  • 151
  • 1
  • 2
  • 14
ConroyP
  • 40,958
  • 16
  • 80
  • 86
  • If a user were to visit http://mysite.com and download style.css, when they go to https://mysite.com would style.css get requested again? – Frank Mar 26 '11 at 08:26
  • 12
    I'm not sure we're all on the same page here. Are we talking about whether HTTPS content will be cached by default, or are asking if it will be cached assuming certain HTTP response headers? The link to the web caching tutorial that you linked to from Mark Nottingham actually indicates that secure (i.e. HTTPS) or authenticated content will not be cached unless the cache-control header indicates that it's public content. – Edward Shtern May 18 '11 at 16:59
  • 2
    Stumbled upon a nice article: http://blog.httpwatch.com/2011/01/28/top-7-myths-about-https/ – roberkules Feb 21 '12 at 14:22
  • 1
    Firefox removed the requirement for Cache-Control: public years ago. – GreenReaper Jun 24 '15 at 15:44
  • 1
    This statement "web browsers should cache content over HTTPS" is wrong to me. Why they should to it? Plus, please check comment below a person from chromium team "https://code.google.com/p/chromium/issues/detail?id=110649#c6" He says "In fact nothing is being cached (on the persistent cache)" – Teoman shipahi Jun 26 '15 at 22:01
  • @Teomanshipahi _"Why they should to it?"_ - Because they are HTTP compliant. _"He says 'In fact nothing is being cached (on the persistent cache)'"_ - That comment refers to the incident, not to the browser in general. – a better oliver Nov 30 '15 at 12:50
  • @Teomanshipahi Why should they cache?? uuh... because of the same reason why they should cache HTTP, for performance, network relief. Why shouldn't they cache? should be the question. – EralpB May 09 '17 at 08:03
  • Knowing this, this is an explicit kind of Meltdown/Specter kind of attack. Very secure... LOL... – Volodymyr Frytskyy Jan 23 '18 at 23:55
0

Https is cached by default. This is managed by a global setting that cannot be overridden by application-defined cache directives. To override the global setting, select the Internet Options applet in the control panel, and go to the advanced tab. Check the "Do not save encrypted pages to disk" box under the "Security" section, but the use of HTTPS alone has no impact on whether or not IE decides to cache a resource.

WinINet only caches HTTP and FTP responses not HTTPS response. https://msdn.microsoft.com/en-us/library/windows/desktop/aa383928%28v=vs.85%29.aspx

Ashim Nath
  • 1