Hacker News Reader

Comment by EGreg | Hacker News Reader

Here's a good excuse for not using https for everything: it breaks caching of files by proxies!

Right. So what's the solution? I run my wife's retail website. Am I supposed to just stop worrying about caching static assets like product images, scripts, etc.? Do I just throw my hands in the air and assume it evens out because I switched to HTTPS?

Serious question, what are my options?

* Ensure your server is setting ETags correctly so the clients can determine which assets they need to re-request.

* Make use of edge CDNs with https termination

Turns out my CDN supports HTTPS (using cloudinary), so that's good. Thanks for the ETag reminder, I'm not doing that yet.

Do you run the cache / contract with someone to run the cache, or are you worried about third parties who run caching servers out of your control (like mobile ISPs, corporate networks, etc.)? If the latter, I'm surprised/curious what the use case is.

If the former, you can stick those on HTTPS too just fine. CloudFlare will be an entire SSL-enabled CDN for you for free. Amazon Cloudfront will serve SSL for you for free (though you still have to pay for Cloudfront itself, and get a cert on your own, though you can do that for free).

Amazon Certificate Manager will issue certificates for CloudFront for free.

That's what CDNs are for. If you control your proxy, nothing prevents you from giving it access to your https by setting up your private key on it. Https is also tapable, but only by servers you trust.

The more privacy-conscious amongst us probably consider that a positive reason not a negative one...

Reply on news.ycombinator.com