I have a controller that responds with a photo, the photo is private and the user needs to be authenticated and authorized to access it. The photo is encrypted and needs to be decrypted on each request. This is why I like the browser to cache the photo.

Using the following this used to work pre 3.4.3

        $response->setMaxAge(604800 /* 1 week */);
        $response->setPrivate();

In #25583 this behaviour has changed that if a session is started nothing can be cached.

I do understand that if the user logs out that the photo would still be in the browser cache but that is a risk I am willing to accept in turn for the huge performance boost.

How would I go about and implement this now?