http://drupal.org/node/303419

From: andrew morton <graveltech@gmail.com>

Incorrect exipration headers with private file transfers
---

 modules/image/image.module |    9 ++++++++-
 1 files changed, 8 insertions(+), 1 deletions(-)


diff --git modules/image/image.module modules/image/image.module
index 410ad28..267cf0c 100644
--- modules/image/image.module
+++ modules/image/image.module
@@ -195,8 +195,15 @@ function image_file_download($filepath) {
       $headers = module_invoke_all('file_download', $original_path);
       if (!in_array(-1, $headers)) {
         return array(
+          // Send headers describing the image's size, and MIME-type...
           'Content-Type' => $info['mime_type'],
           'Content-Length' => $info['file_size'],
+          // ...and allow the file to be cached for two weeks (matching the
+          // value we/ use for the mod_expires settings in .htaccess) and
+          // ensure that caching proxies do not share the image with other
+          // users.
+          'Expires' => gmdate(DATE_RFC1123, time() + 1209600),
+          'Cache-Control' => 'max-age=1209600, private, must-revalidate',
         );
       }
     }
@@ -567,7 +574,7 @@ function image_style_url($style_name, $path) {
   // Set a cache entry to grant access to this style/image path. This will be
   // checked by image_style_generate().
   cache_set('access:' . $style_name . ':' . md5($path), 1, 'cache_image', REQUEST_TIME + 600);
-  
+
   $scheme = file_uri_scheme($path);
   $target = file_uri_target($path);