Yes, PhotoController should have caches_action on it. Make sure that a photo cached as one user isn't available via cache to the anonymous user, or to a different user ID. You might have to add a before_filter that verifies the presence of session[:user_id] (instead of the current check inside the my_photo method).