How can I convince Firefox (3.0.1, if it matters) to send an If-Modified-Since header in an HTTPS request? It sends the header if the request uses plain HTTP and my server dutifully honors it. But when I request the same resource from the same server using HTTPS instead (i.e., simply changing the http:// in the URL to https://) then Firefox does not send an If-Modified-Since header at all. Is this behavior mandated by the SSL spec or something?
Here are some example HTTP and HTTPS request/response pairs, pulled using the Live HTTP Headers Firefox extension, with some differences in bold:
HTTP request/response:
http://myserver.com:30000/scripts/site.jsGET /scripts/site.js HTTP/1.1Host: myserver.com:30000User-Agent: Mozilla/5.0 (...) Gecko/2008070206 Firefox/3.0.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-us,en;q=0.5Accept-Encoding: gzip,deflateAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7Keep-Alive: 300Connection: keep-aliveIf-Modified-Since: Tue, 19 Aug 2008 15:57:30 GMTIf-None-Match: "a0501d1-300a-454d22526ae80"-gzipCache-Control: max-age=0HTTP/1.x 304 Not ModifiedDate: Tue, 19 Aug 2008 15:59:23 GMTServer: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8Connection: Keep-AliveKeep-Alive: timeout=5, max=99Etag: "a0501d1-300a-454d22526ae80"-gzip
HTTPS request/response:
https://myserver.com:30001/scripts/site.jsGET /scripts/site.js HTTP/1.1Host: myserver.com:30001User-Agent: Mozilla/5.0 (...) Gecko/2008070206 Firefox/3.0.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-us,en;q=0.5Accept-Encoding: gzip,deflateAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7Keep-Alive: 300Connection: keep-aliveHTTP/1.x 200 OKDate: Tue, 19 Aug 2008 16:00:14 GMTServer: Apache/2.2.8 (Unix) mod_ssl/2.2.8 OpenSSL/0.9.8Last-Modified: Tue, 19 Aug 2008 15:57:30 GMTEtag: "a0501d1-300a-454d22526ae80"-gzipAccept-Ranges: bytesContent-Encoding: gzipContent-Length: 3766Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/javascript
UPDATE: Setting browser.cache.disk_cache_ssl to true did the trick (which is odd because, as Nickolay points out, there's still the memory cache). Adding a "Cache-control: public" header to the response also worked.
