We are having problems playing audio files from the HTML5 audio component from the S3 service.

Steps to reproduce it:

1.- Upload some mp3 file to S3 service
2.- Use signed url in some HTML5 audio component like
```
    <audio controls="controls">
        <source src="http://localstack:4572/local-bucket/test.mp3?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Security-Token=xxx%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxx%2F20190416%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190416T150211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=172800&X-Amz-Signature=xxx" type="audio/mpeg">
    </audio>
```

When we try to reproduce it we get CORB problem from Chrome,

```
Cross-Origin Read Blocking (CORB) blocked cross-origin response http://localstack:4572/local-bucket/test.mp3?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Security-Token=xxx%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxx%2F20190416%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190416T150211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=172800&X-Amz-Signature=xxx with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.
```

Doing some test we realize that the http calls done by audio component to audio asset returns a wrong Content-Type header.

First call,

Request,
```
Request URL: http://localstack:4572/local-bucket/test.mp3?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Security-Token=xxx%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxx%2F20190416%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190416T150211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=172800&X-Amz-Signature=xxx
Request Method: GET
Status Code: 200 OK
Remote Address: xx.xx.xx.xx:4572
Referrer Policy: no-referrer-when-downgrade
```

Response,
```
Access-Control-Allow-Headers: authorization,content-type,content-md5,cache-control,x-amz-content-sha256,x-amz-date,x-amz-security-token,x-amz-user-agent
Access-Control-Allow-Methods: HEAD,GET,PUT,POST,DELETE,OPTIONS,PATCH
Access-Control-Allow-Origin: *
Content-Length: 6584528
Content-Md5: RpfskSSCIEXm7I9lGuMsBA==
Content-Type: audio/mpeg
Date: Wed, 17 Apr 2019 14:27:05 GMT
ETag: "4697ec9124822045e6ec8f651ae32c04"
last-modified: Wed, 17 Apr 2019 14:24:23 GMT
Server: BaseHTTP/0.3 Python/2.7.15
```

Second call, with a partial content,

Request,
```
Request URL: http://localstack:4572/local-bucket/test.mp3?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Security-Token=xxx%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxx%2F20190416%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190416T150211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=172800&X-Amz-Signature=xxx
Request Method: GET
Status Code: 206 Partial Content
Remote Address: xx.xx.xx.xx:4572
Referrer Policy: no-referrer-when-downgrade
```

Response,
```
Access-Control-Allow-Headers: authorization,content-type,content-md5,cache-control,x-amz-content-sha256,x-amz-date,x-amz-security-token,x-amz-user-agent
Access-Control-Allow-Methods: HEAD,GET,PUT,POST,DELETE,OPTIONS,PATCH
Access-Control-Allow-Origin: *
Content-Length: 6584528
Content-Range: bytes 0-6584527/6584528
Content-Type: text/html; charset=utf-8
Date: Wed, 17 Apr 2019 14:27:05 GMT
Server: BaseHTTP/0.3 Python/2.7.15
```

Here, we are getting Content-Type: text/html and this causes the CORB problem.

Trying the same from a real S3 service:

First call,

Request,

```
Request URL: https://xxx.s3.amazonaws.com/xxx.mp3
Request Method: GET
Status Code: 304 Not Modified
Remote Address: xx.xx.xx.xx:443
Referrer Policy: no-referrer-when-downgrade
```

Response,

```
Date: Wed, 17 Apr 2019 14:34:37 GMT
ETag: "5d79d70934b79a527383c87a7d22dc3a"
Last-Modified: Wed, 17 Apr 2019 10:21:17 GMT
Server: AmazonS3
x-amz-id-2: 1tX9Ni8GfNVZNBrK7KtdamP+6fxeoTIo0pMzLlLMGiIoAGEM3qpm12UoPktkjDxLiLWj16v2hbo=
x-amz-meta-gid: 33
x-amz-meta-mode: 33277
x-amz-meta-mtime: 1555496476
x-amz-meta-uid: 33
x-amz-request-id: 9AA70366CB6D9C73
x-amz-version-id: null
```

Second call, with partial content,

Request,

```
Request URL: https://xxx.s3.amazonaws.com/xxx.mp3
Request Method: GET
Status Code: 206 Partial Content
Remote Address: xx.xx.xx.xx:443
Referrer Policy: no-referrer-when-downgrade
```

Response,

```
Accept-Ranges: bytes
Content-Length: 5952573
Content-Range: bytes 0-5952572/5952573
Content-Type: audio/mpeg
Date: Wed, 17 Apr 2019 14:34:37 GMT
ETag: "5d79d70934b79a527383c87a7d22dc3a"
Last-Modified: Wed, 17 Apr 2019 10:21:17 GMT
Server: AmazonS3
x-amz-id-2: xxx
x-amz-meta-gid: 33
x-amz-meta-mode: 33277
x-amz-meta-mtime: 1555496476
x-amz-meta-uid: 33
x-amz-request-id: 9AA70366CB6D9C73
x-amz-version-id: null
```

In summary, when a partial content request is made it is always served as text/html and this generates the CORB problem.

We also try to set a CORS policy including `X-Content-Type-Options: nosniff` header via ExposeHeaders in order to prevent CORB check but the service doesn't allow this header.

We believe that the solution could be to send the correct `Content-Type` header or in case this is impossible, always include the `X-Content-Type-Options: nosniff` header in all the responses of the S3 service.
import re
import logging
import json
import uuid
import base64
import codecs
import xmltodict
import collections
import botocore.config
import six
import datetime
import dateutil.parser
from six.moves.urllib import parse as urlparse
from botocore.client import ClientError
from requests.models import Response, Request
from localstack import config, constants