Can cache-control and basic authentication coexist?

[encyclo]

I'm looking to speed us the viewing of some large graphics on a small site which uses basic authentication (Apache) controlling access for a small number of users. As the files are static, I can easily use a simple rule like

ExpiresByType image/jpeg "access plus 1 year"

- but does anyone have experience regarding cache-control headers and preserving the authentication?

I want the files to be stored in the user cache but don't want intermediate public caches to serve the content without authentication.

[lammert]

Using the cache control type "private" should do the trick, as this one is explicitly designed for signaling intermediate public caches to not store the content.

RFC about cache headers [w3.org] section 14.9.1