views:

833

answers:

6

Hello, I'm using the WebDevHelper toolbar for Internet Explorer to troubleshoot HTTP requests/roundtrips on my SSL site and noticed that IE re-downloads my CSS :hover images every time they are triggered. This causes a huge amount of roundtrips.

How can I prevent this from happening?

Edit: All static content is served with cache-control: public, so images, javascript etc. are cached in Firefox and Chrome. This problem is IE specific.

A: 

Content served via SSL will not be cached for security reasons. If you want something to be cached, serve it via HTTP.

recursive
That's not true as a blanket statement. Firefox caches correctly (I have cache-control:public on all static content), so do Chrome and Safari.
Alex
don't server http resources over an https page. You will get ugly errors that will freak out users.
Byron Whitlock
Cannot serve HTTP with HTTPS with out getting a bunch of errors on the screen.
Nick Berardi
Alex: I did not know that. What is the cache-control you're referring to? Is that an http[s] header?
recursive
Yes "cache-control" is a header that tells the browser how to serve your page.
Nick Berardi
Yes cache-control is a response header directive. It tells downstream proxies and clients that caching is explicitly allowed/desired.
Alex
There's different caching headers, I wouldn't expect they're all supported consistently. It sounds like you found one IE does not support.
Frank Schwieterman
A: 

Have you tried adding to the header for those type of static files.

P3P: CP="CAO PSA OUR"

I know this works with in IE to allow storage of cookies through framesets and stuff. Not sure if it works with static files under HTTPS.

Nick Berardi
Tried it, still getting re-requests for all the images. Which is really nasty if you have a (off/on/hover) 3-image combination.
Alex
+1  A: 

Serve static content via http, sure, but don't do separate images for :hover states. Proper css image sprites should be used. It's just good practice all around, via https or http. There are tons of resources available for creating sprites. Supposedly SpriteMe, [ http://spriteme.org/ ] is an attempt to automate css image sprite creation.

jasonevers
I can't serve static content via http in an https environment. That creates the nasty 'contains insecure content' warning.
Alex
I'd say your best bet is to create some css sprites! You'll cut down on http requests across all browsers too.
jasonevers
+1  A: 

Well there are multiple issues according to other Stackoverflow posts. FireFox 2.x also has this problem. But FireFox 3.x doesn't.

http://stackoverflow.com/questions/174348/will-web-browsers-cache-content-over-https/174509#174509

Also in Internet Explorer, you go to Tools > Internet Options > Advanced tab > Security section > Do not save encrypted pages to disk. It appears to be unchecked by default in IE6, 7 and 8.

Nick Berardi
A: 

I know it sounds weird... try to put a url to something that isn't exists (404 error). after this, all the rest of the images will be cached.

Liad Magen
+1  A: 

If the images are being delivered from a different hostname than your main page, then you're hitting the artifact described here: http://blogs.msdn.com/ieinternals/archive/2010/04/21/Internet-Explorer-May-Bypass-Cache-for-Cross-Domain-HTTPS-Content.aspx

EricLaw -MSFT-