Revalidate a Proxied Download with Cache-Control: no-cache

The download URL is correct, but a shared proxy still has a stored response. If the operation needs a response validated with the origin, put that requirement on the request:

from urllib.request import ProxyHandler, Request, build_opener
import shutil

opener = build_opener(ProxyHandler({
    "https": "http://proxy.example:8080",
}))
request = Request(download_url, headers={"Cache-Control": "no-cache"})
with opener.open(request, timeout=15) as response:
    shutil.copyfileobj(response, output)

This fragment assumes the application owns a binary output stream and supplies an HTTPS download_url. To try a permitted public download without proxy authentication, use an HTTP endpoint candidate from the HTTP proxy list in the opener; the request’s cache requirement stays the same. It keeps the original resource URL while asking caches on the request path to validate before reuse.

Validation can reuse the stored bytes

A conforming cache receiving no-cache cannot satisfy this request from a stored response without successful validation with the origin. The origin can confirm that the stored representation remains valid, so the operation need not retransmit an unchanged file from the origin.

A request's max-age=0 expresses an age limit. It is useful when the application wants a response no older than that limit, but it is not a prohibition on storage. A response that has just been generated can meet it.

Adding a random query parameter asks for a different target URI. That can produce another cache entry or even change the application's response. Use a query parameter only when it is part of the resource's intended interface.

For ordinary HTTPS CONNECT, the tunneling proxy cannot see this header inside TLS. The policy can still reach the origin and caches handling the decrypted HTTP exchange. Check where the stored response actually lives before attributing it to the tunnel.