up vote 0 down vote favorite
share [g+] share [fb]

Is it possible to set expiry dates of static files served with IIS6 over SSL? I'm trying to deliver javascript and css files in such a way that they can be cached by a browser.

link|improve this question
feedback

2 Answers

up vote 0 down vote accepted

A browser should never cache content downloaded over a HTTPS connection, neither should any proxy between the browser and your server.

The only way to do this would be to serve the stylesheets and javascript from a HTTP service, but then your users will see the "this page contains both secure and insecure content" message (or their browser's equivalent).

It would be nice to be able to tell the client (or proxies) that some content is not sensitive and therefore can be stored in cache, but there is no (standard) method of doing this.

link|improve this answer
I was already afraid of that answer as it was experience but I wanted to make sure. How are other people coping with this problem? – XIII Aug 2 '09 at 9:57
Reducing the size of the content by filtering out commends and white-space and/or using compression (built in IIS6+ though a pain to enable before 7) to reduce bandwidth use, is about all you can do aside from using mixed HTTPS/HTTP content or just putting up with it. If a page uses several stylesheets or script files, you can try concatenating them into one file to reduce latency (less requests per page) and slightly improve the gain you get from compression. – David Spillett Aug 2 '09 at 11:19
I'm already using YUICompressor to minify and obfuscate them and used csstidy to minify the css files. I also pack everything together in a file as I read developer.yahoo.com/performance/rules.html, a very interesting read. – XIII Aug 2 '09 at 12:50
Try enabling GZip compression for static files as well. Enabling it in IIS6 is not as hard has David made out. You need to add the GZip filter, enable it, enable editing of the Metabase, and then add all the extension you want to be compressed into the metabase. It's about 20 minutes work, but it's well worth it. It dropped our HTTPS load times from ~ 2 seconds to < 0.5 seconds: wwwcoder.com/main/parentid/170/site/3669/68/default.aspx (There's a lot of fluff in that article, just skip the the action points). – Mark Henderson♦ Aug 16 '09 at 21:30
feedback
up vote 0 down vote

You can actually set headers to cache some HTTPS content, however not everything trusts it or will save for more then one session.

In apache it's just the standard mod_expires, and their is a similar setting available for IIS.

link|improve this answer
Do you happen to know which setting? It's only for css and javascript files so I would think these are classified as safe. – XIII Aug 2 '09 at 12:46
According to this: microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/… IIS has less support then I'd thought. – LapTop006 Aug 2 '09 at 22:57
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.