thank you Maxim,

the resourse was saved to cache but was quickly expiring in the browser causing a Cache-Control: no-cache header to be sent.

Sending something like

Cache-Control: public,max-age=15,s-maxage=240;must-revalidate,stale-while-revalidate=240

together with Last-Modified/ETag from the upstream server seem to be getting me where I want.

Thanks for pointing me in the right direction.


@jeanpaul: I didn't have the chance to check your idea since taking a closer look at the headers really helped moving forward.