5 ms·
The use of HTTPS doesn't destroy cacheability, it just requires that one of the legitimate endpoints authorize the cache to be there.
by bifurcation 11y ago
The use of HTTPS doesn't destroy cacheability, it just requires that one of the legitimate endpoints authorize the cache to be there.
- voidlogic 11y agoRight, it forces the cache to come from the content provider rather than being provided downstream by the client's organization.
- Dylan16807 11y agoIf it's inside the organization then they can put in a local cert and run a cache. It only prevents caches that are in the middle and trusted by neither end. I'm okay with that in almost all cases.
- voidlogic 11y agoWhat about dorms, hospitals (patient wifi), libraries, hotels, cafes and small ISPs? They do not have access to their clients certs-
- profmonocle 11y agoBut for many users, their downstream organization is their ISP. From my point of view, any caching by them is malicious. I didn't send my request to the IP of their caching server, I sent it to the IP of the site I'm trying to reach. Redirecting my request to their cache is a MITM attack. If my employer wants to use caching, they can install a cert for their proxy on my machine (or require me to do so), so it's not a problem - although it is more technically complex.