http://drupal.org/node/303419

From: andrew morton <graveltech@gmail.com>

Incorrect exipration headers with private file transfers
---

 modules/image/image.module |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)


diff --git modules/image/image.module modules/image/image.module
index a6c3411..693ec14 100644
--- modules/image/image.module
+++ modules/image/image.module
@@ -204,9 +204,13 @@ function image_file_download($filepath) {
       // Check the permissions of the original to grant access to this image.
       $headers = module_invoke_all('file_download', $original_path);
       if (!in_array(-1, $headers)) {
+        // Send headers describing the image's size and MIME-type and allowing
+        // it to be cached for two weeks.
         return array(
           'Content-Type' => $info['mime_type'],
           'Content-Length' => $info['file_size'],
+          'Expires' => gmdate(DATE_RFC1123, time() + 1209600),
+          'Cache-Control' => 'max-age=1209600, private, must-revalidate',
         );
       }
     }
@@ -577,7 +581,7 @@ function image_style_url($style_name, $path) {
   // Set a cache entry to grant access to this style/image path. This will be
   // checked by image_style_generate().
   cache_set('access:' . $style_name . ':' . md5($path), 1, 'cache_image', REQUEST_TIME + 600);
-  
+
   $scheme = file_uri_scheme($path);
   $target = file_uri_target($path);