<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>yes</td>
</tr>
<tr>
<td>Feature request?</td>
<td>no</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>yes</td>
</tr>
<tr>
<td>RFC?</td>
<td>no</td>
</tr>
<tr>
<td>Symfony version</td>
<td>^3.4.3</td>
</tr>
</tbody>
</table>
<p dir="auto">I have a controller that responds with a photo, the photo is private and the user needs to be authenticated and authorized to access it. The photo is encrypted and needs to be decrypted on each request. This is why I like the browser to cache the photo.</p>
<p dir="auto">Using the following this used to work pre 3.4.3</p>
<div class="highlight highlight-text-html-php notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="        $response-&gt;setMaxAge(604800 /* 1 week */);
        $response-&gt;setPrivate();"><pre class="notranslate">        <span class="pl-s1"><span class="pl-c1">$</span>response</span>-&gt;<span class="pl-en">setMaxAge</span>(<span class="pl-c1">604800</span> <span class="pl-c">/* 1 week */</span>);
        <span class="pl-s1"><span class="pl-c1">$</span>response</span>-&gt;<span class="pl-en">setPrivate</span>();</pre></div>
<p dir="auto">In <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="284183422" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/25583" data-hovercard-type="pull_request" data-hovercard-url="/symfony/symfony/pull/25583/hovercard" href="https://github.com/symfony/symfony/pull/25583">#25583</a> this behaviour has changed that if a session is started nothing can be cached.</p>
<p dir="auto">I do understand that if the user logs out that the photo would still be in the browser cache but that is a risk I am willing to accept in turn for the huge performance boost.</p>
<p dir="auto">How would I go about and implement this now?</p>
<table role="table">
<thead>
<tr>
<th>Q</th>
<th>A</th>
</tr>
</thead>
<tbody>
<tr>
<td>Bug report?</td>
<td>yes</td>
</tr>
<tr>
<td>Feature request?</td>
<td>no</td>
</tr>
<tr>
<td>BC Break report?</td>
<td>no</td>
</tr>
<tr>
<td>RFC?</td>
<td>no</td>
</tr>
<tr>
<td>Symfony version</td>
<td>3.4</td>
</tr>
</tbody>
</table>
<p dir="auto">This issue is a follow-up to <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="290899970" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/25902" data-hovercard-type="issue" data-hovercard-url="/symfony/symfony/issues/25902/hovercard" href="https://github.com/symfony/symfony/issues/25902">#25902</a>. <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/leofeyer/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/leofeyer">@leofeyer</a>, <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/Toflar/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/Toflar">@Toflar</a> and me re-analyzed the problem: The <code class="notranslate">ResponseCacheStrategy</code> sets the response to <code class="notranslate">no-cache, must-revalidate</code> if any of the responses is set to <code class="notranslate">private</code>. This is incorrect, as <code class="notranslate">private</code> means it should be cacheable by the <strong>browser</strong>, just not by any shared cache.</p>
<p dir="auto">Because the <a href="https://github.com/symfony/symfony/blob/master/src/Symfony/Component/HttpFoundation/Response.php#L515-L526"><code class="notranslate">Response::isCacheable</code> method</a> returns <code class="notranslate">false</code> if a response is <code class="notranslate">private</code>, the <code class="notranslate">ResponseCacheStrategy</code> <strong>replaces</strong> the <code class="notranslate">private</code> header with a <code class="notranslate">no-cache, must-revalidate</code>.</p>
<p dir="auto"><a href="https://tools.ietf.org/html/rfc7234#section-5.2.2.6" rel="nofollow">RFC 7234</a> says:</p>
<blockquote>
<p dir="auto">The "private" response directive indicates that the response message is intended for a single user and MUST NOT be stored by a shared cache.  A private cache MAY store the response and reuse it for later requests, even if the response would normally be non-cacheable.</p>
</blockquote>
<p dir="auto">/cc <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/nicolas-grekas/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/nicolas-grekas">@nicolas-grekas</a></p>