Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem with a system I develop related to IE8 downloading over SSL (ie on sites using https://...) and is described on this MS kb article.

We use the HTTPCacheability.NoCache option as the data being downloaded is sensitive, and is downloaded from a secured site. I don't want that data to be cached on any of the proxies, the client, or the server.

The article describing the issue details a fix to the client side registry changing a BypassSSLNoCacheCheck setting.

I don't want to loosen the system security just for IE8, as the system works fine on anything more upto date. Getting all the clients to apply the hotfix is difficult at best, and impossible at worst. We need to support IE8 in the system, at least for now.

So:

  1. Does the detailed hotfix have any implications for the security at the browser end in IE8 - does it mean the file will be cached? (in a place other than where the user saves the file).

  2. Is there some way I can get these files downloadable with a change at the server end that doesn't break the security side of things?

share|improve this question
add comment

migrated from webmasters.stackexchange.com Oct 15 '12 at 11:48

This question came from our site for pro webmasters.

1 Answer

Relying on a client browser cache setting does not add much security. Have you tried ServerAndPrivate?

http://msdn.microsoft.com/en-us/library/system.web.httpcacheability%28v=vs.100%29.aspx

share|improve this answer
    
ServerAndPrivate does remove the download error, but causes the doc to be cached, even if its only on the server or by the client. We're a little bit subject to Pen Testers for this, but the NoCache setting has been corroborated by a couple of different Pen Tests and other sources. –  Jon Egerton Oct 15 '12 at 12:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.