Is data retrieved over SSL cached by the client browser?

Question

I know that data retrieved over SSL (https) is encrypted over the wire, but once it arrives at the browser, is it stored in the client's browser cache? If so, is it stored encrypted or in plain text?

This probably depends on the browser, so perhaps different browsers do different things? Modern browsers better behaved than outdated ones?

Answer 1

You can use the standard Cache-Control HTTP header to control the client's behaviour. It is possible to disable caching, e.g. Cache-Control: no-cache.

As far as I know, most desktop browsers store the cache unencrypted.