Is there a way to specify that a resource should be cached when accessed over both HTTP and HTTPS? We have lots of static content that is initially served over HTTP and then re-served over SSL when the user tries to sign up or login, and it would be nice to cache that.
No, browsers will treat HTTP and HTTPS URLs as completely different, even if the only actual difference is the presence of the
If they did not, this would create a serious security hole. Consider what would happen if, say, an attacker managed to tamper with a JS file loaded over insecure HTTP, and the browser later re-ran the same JS code from its cache on a secure page.
The only way you can reuse the same static resources on both secure and insecure pages is to load them from the exact same URLs. Here, you have basically two choices:
Of course, you also have a third option: just use HTTPS for all of your pages. This might be more practical than you'd think, especially if a substantial fraction of your traffic is already using HTTPS.
I have not found anything that specifically states how browsers should handle sharing https and http cached content, and I have found conflicting information online as well.
Even though both http and https cached content, the https site did not fetch cached http resources. Anyway, here are a few articles that could be useful:
Hope this helps!