Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a problem with a system I develop related to IE8 downloading over SSL (ie on sites using https://...) and is described on this MS kb article.

We use the HTTPCacheability.NoCache option as the data being downloaded is sensitive, and is downloaded from a secured site. I don't want that data to be cached on any of the proxies, the client, or the server.

The article describing the issue details a fix to the client side registry changing a BypassSSLNoCacheCheck setting.

I don't want to loosen the system security just for IE8, as the system works fine on anything more upto date. Getting all the clients to apply the hotfix is difficult at best, and impossible at worst. We need to support IE8 in the system, at least for now.


  1. Does the detailed hotfix have any implications for the security at the browser end in IE8 - does it mean the file will be cached? (in a place other than where the user saves the file).

  2. Is there some way I can get these files downloadable with a change at the server end that doesn't break the security side of things?

share|improve this question

migrated from Oct 15 '12 at 11:48

This question came from our site for pro webmasters.

Relying on a client browser cache setting does not add much security. Have you tried ServerAndPrivate?

share|improve this answer
ServerAndPrivate does remove the download error, but causes the doc to be cached, even if its only on the server or by the client. We're a little bit subject to Pen Testers for this, but the NoCache setting has been corroborated by a couple of different Pen Tests and other sources. – Jon Egerton Oct 15 '12 at 12:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.