I am trying to cache static resources for the angular app (Angular v10) getting called in an iframe from my parent angular application. I have spring security on my rest layer on both the apps(parent app and the app getting called in iframe). Also, using zuul proxy in my parent app to route the request to the iframe app.

Cache control for static resources works properly on the parent app but for the iframe application I get two cache-control entries in Response Header. Looks like browser give preference to no-cache instead of the max-age.

- cache-control: no-cache 
- cache-control: max-age=350, must-revalidate, private (this is what I have configured in my child app using WebMvcConfigurer).

Not able to figure out the cause of no-cache cache-control entry. Can it be because the use of iframe in angular. I didn't find any configuration which explicitly adds this.

I have completely disabled the cache control policy of spring security to rule out any response header alteration by spring security.

http.headers().cacheControl().disable();

Also used the following zuul configuration to pass downstream headers without any modification by zuul proxy.

sensitiveHeaders: (blank)
ignore-security-headers: false

This looks to be working fine as verified from zuul debug headers in response.

Any ideas on what I am missing out or doing wrong?