2

A lot of resources claim that websites with HTTPS + SSL will not be cached.

  • Is this true?
  • If so, why?
  • If so, can this be prevented?

I heard that this depends on the browser, but that the most browsers won't cache HTTPS.

3

Yes, HTTPS content is cacheable.

Historically, authenticated or content obtained via HTTPS may not have been cached by the browsers. This was never a technical requirement but thought as a good security practice. For example, Firefox used to cache HTTPS content only in memory. However, as the use of HTTPS increased, caching SSL enabled content to the disk became default.

The important thing is to set Cache-control headers. Google has a good article on HTTP caching. I recommend you review it.

You can use curl -I at the command line to check cache headers:

curl -I www.google.com
HTTP/1.1 200 OK
Date: Thu, 11 Sep 2014 13:54:52 GMT
Expires: -1
Cache-Control: private, max-age=0

Or there are online tools like http://redbot.org

I highly recommend setting Cache-Control headers are on all content. I also recommend setting explicit headers, such as max-age.

With the increasing use of mobile, CDNs, content acceleration providers, users are often connecting via some sort of proxy. So you want to assure you have good cache policies so these proxies no how to handle your content.

In the example above, you will see private. Historically, some user-agents would not cache data to disk when this directive is in place, but this practice is changing as well.

For a detailed review of this, please see this 2013 report:

Industry-Wide Misunderstandings of HTTPS

  • Nice answer. Simple and it answers the question. – William Edwards Sep 11 '14 at 14:12
  • I had to dig the link out of my bookmarks but I just added one of the best reports I've seen recently on this issue. Today it is probably a bigger challenge NOT to have your HTTPS data cached than to have it cached. – jeffatrackaid Sep 11 '14 at 14:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.