title: CakePHP, restricting access to images through a media controller, and caching
body: <p>I'm playing around with an CakePHP site based around the following principles:</p>
  
  <ul>
  <li>An admin can upload images and tag models in them.</li>
  <li>The admin can choose to make certain photos public, for a publicly visible portfolio.</li>
  <li>The admin can invite people to join the site by using a key to register which will associate the user with a certain model. The user will then be able to see all photos of him/her on a private part of the site requiring login, kind of like a private portfolio for each individual model.</li>
  <li>All images are placed in a folder with <code>deny from all</code> .htaccess file blocking off access.</li>
  <li>A media controller takes care of serving the images, and when a request for a file is made, a  database table lookup is done and access is given if: the user is logged in and an admin; the user is logged in and is tagged in the photo; or of the photo is marked as public. If not a status code of 403 is returned. </li>
  <li>To make the whole experience more snappy and avoid unnecessary downloads, caching is used, where the edit timestamp of the file is checked and a corresponding status code of <code>304</code> is sent (through setting <code>$this-&gt;response-&gt;modified</code> to the file timestamp and checking <code>$this-&gt;response-&gt;checkNotModified($this-&gt;request)</code> on requests).</li>
  <li>The image is sent via the <code>$this-&gt;response-&gt;file</code> in the controller <code>MediaController</code>.  </li>
  </ul>
  
  <p>All in all this works as expected, but there's one problem: If for some reason a photo which isn't supposed to be public is exposed by an error, the caching poses a problem. </p>
  
  <p>Say someone who do have access to the file logs in and they are able to view/download the photo as expected. This user then logs off, and someone else takes over the PC. They go to the public portfolio page where the same private photo is exposed by some error (basically a bug or human admin error), but since the last user who logged in did have access to it, it's in the cache, and even though the server returns a status code of <code>403</code>, the browser will ignore that and serve the image from cache. </p>
  
  <p>If I haven't lost you, my question is this: Is there any way around this problem? Can I force the browser to take into account the 403 status code? Or is there some other flaw in my media controller setup/design which makes it unusable?</p>
  
  <p>Or is this problem too unlikely to ever pose a problem for a small, amateur photographer? Would it be considered a (severe) security flaw for a professional well known photographer?</p>
  
  <p>Any insight is greatly appreciated! :)</p>