What must I do to make content such as images served over HTTPS be cached client-side?

Question

I am using Tomcat as a server and Internet Explorer 6 as a browser. A web page in our app has about 75 images. We are using SSL. It seems to be very slow at loading all the cont

Answer 1

Maybe you can add an additional server/subdomain that provides the images without https?

Answer 2

Some browsers will cache SSL content. Firefox 2.0+ does not cache SSL resources on disc by default (for increased privacy). Firefox 3+ doesn't cache them on disc unless the Cache-control:public header appears.

So set the Expires: header correctly and Cache-control:public. e.g.

<Files ~ "\.(gif|jpe?g|png|ico|css|js|cab|jar|swf)$">
        # Expire these things
        # Three days after access time
        ExpiresDefault  "now plus 3 days"
        # This makes Firefox 3 cache images over SSL
        Header set Cache-Control public
</Files>

Answer 3

The first answer is correct that nothing is cached when using HTTPS. However, when you build your web page, you may consider referencing the images by their individual URL's. This way you can specify the images as originating from an HTTP source, and they'll(likely) be cache'd by the browser.

Answer 4

75 images sounds like a lot. If it is a lot of small images, there are ways of bundling many images as one, you might see if you can find a library that does that. Also you can probably force the images to be cached in something like google gears.

Answer 5

If you are serving a page over https then you'll need to serve all the included static or dynamic resources over https (either from the same domain, or another domain, also over https) to avoid a security warning in the browser.

Content delivered over a secure channel will not be written to disk by default by most browsers and so lives in the browsers memory cache, which is much smaller than the on disk cache. This cache also disappears when the application quits.

Having said all of that there are things you can do to improve the cachability for SSL assets inside a single browser setting. For starters, ensure that all you assets have reasonable Expires and Cache-Control headers. If tomcat is sitting behind apache then use mod_expires to add them. This will avoid the browser having to check if the image has changed between pages

<Location /images>
   FileEtag none
   ExpiresActive on
   ExpiresDefault "access plus 1 month"
</Location>

Secondly, and this is specific to MSIE and Apache, most apache ssl configs include these lines

SetEnvIf User-Agent ".*MSIE.*" \
     nokeepalive ssl-unclean-shutdown \
     downgrade-1.0 force-response-1.0

Which disables keepalive for ALL MSIE agents. IMHO this is far too conservative, the last MSIE browsers to have issues using SSL were 5.x and unpatched versions of 6.0 pre SP2, both of which are very uncommon now. The following is more lenient and will not disable keepalives when using MSIE and SSL

BrowserMatch "MSIE [1-4]" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
BrowserMatch "MSIE [5-9]" ssl-unclean-shutdown

Answer 6

Content served over a HTTPS connection never gets cached in the browser. You cannot do much about it.

Usually, images in your web site are not very sensitive and are served over HTTP for this very reason.