HTTPS and Shared Caching

[mnot@…]

p1 2.7.2 currently says that HTTPS uri responses "... MUST NOT be reused for shared caching." If true, this requirement needs to be explicitly added to p6, and referenced from here.

[mnot@…]

In Atlanta:

rf: the statement in question only applies to agent-side intermediaries and user agents, not to content accelerators, which are part of the origin server

rf: some user agents use a common interface to make the request, then have separate logic to decide how that information is made available to other users

rf: to know whether it is safe to send to other servers, you have to know the content

mnot: you can use Cache-Control

...some disagreement here

roberto peon: there are transformative intermediaries; we don't need to specify this

mnot: need to know who this applies to

rf: this applies to libraries in clients

mnot: segregation... a shared cache can even apply to the same box

martin t: 'never "public"' contradicts what has been said about caching rules

paul leach: override

Patrick McManus?: on a phone, different apps can share the same network context

[fielding@…]

From [2040]:

https scheme does not imply cache must be private; addresses #410