Is data retrieved over SSL cached by the client browser?

Question

I know that data retrieved over SSL (https) is encrypted over the wire, but once it arrives at the browser, is it stored in the client's browser cache? If so, is it stored encrypted or in plain text?

This probably depends on the browser, so perhaps different browsers do different things? Modern browsers better behaved than outdated ones?

Answer 1

You can use the standard Cache-Control HTTP header to control the client's behaviour. It is possible to disable caching, eg Cache-Control: no-cache .

As far as I know, most desktop browsers store the cache unencrypted.

Answer 2

I believe that this is browser-specific. For example, Firefox has a preference about this in about:config see this article in Mozilla's KB . I don't know about other browsers (IE might have something in advanced security settings).