I'm considering the relative benefits/disadvantages of making a login page cacheable. Note that here I'm referring to the page containing the form into which the user enters their username and password.
Certainly it doesn't add any protection against SSL stripping (the HTTP page is treated as a seperate entity from the HTTPS age for caching purposes).
It would seem to add some value in protecting the form from modification by rogue certificates and potentially against future issues in SSL - although it can only enhance the integrity of the form for entering the data - which must then be sent over a compromised connection. Does this nulify all the benefits of loading the page from the local cache?
I did find this report which asserts that caching the login page is a vulnerability, on the grounds that "It is not recommended to enable the web browser to save any login information, since this information might be compromised when a vulnerability exists" - however the login page is surely the one form we really don't want to pre-populate before sending to the browser? OTOH there would be issues in using a challenge/response based mechanism where the challenge is issued within the login page - but then it simply won't work rather than compromising the security.
It does not open a new attack vector via the browser cache - this already exists when the page is served as non-cacheable (although it does potentially make an attack by this root a bit simpler if the page is already in the cache).
Is there a significant benefit/disadvantage I have overlooked here?