We are having problems playing audio files from the HTML5 audio component from the S3 service.

Steps to reproduce it:

1.- Upload some mp3 file to S3 service
2.- Use signed url in some HTML5 audio component like
```
    <audio controls="controls">
        <source src="http://localstack:4572/local-bucket/test.mp3?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Security-Token=xxx%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxx%2F20190416%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190416T150211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=172800&X-Amz-Signature=xxx" type="audio/mpeg">
    </audio>
```

When we try to reproduce it we get CORB problem from Chrome,

```
Cross-Origin Read Blocking (CORB) blocked cross-origin response http://localstack:4572/local-bucket/test.mp3?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Security-Token=xxx%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxx%2F20190416%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190416T150211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=172800&X-Amz-Signature=xxx with MIME type text/html. See https://www.chromestatus.com/feature/5629709824032768 for more details.
```

Doing some test we realize that the http calls done by audio component to audio asset returns a wrong Content-Type header.

First call,

Request,
```
Request URL: http://localstack:4572/local-bucket/test.mp3?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Security-Token=xxx%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxx%2F20190416%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190416T150211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=172800&X-Amz-Signature=xxx
Request Method: GET
Status Code: 200 OK
Remote Address: xx.xx.xx.xx:4572
Referrer Policy: no-referrer-when-downgrade
```

Response,
```
Access-Control-Allow-Headers: authorization,content-type,content-md5,cache-control,x-amz-content-sha256,x-amz-date,x-amz-security-token,x-amz-user-agent
Access-Control-Allow-Methods: HEAD,GET,PUT,POST,DELETE,OPTIONS,PATCH
Access-Control-Allow-Origin: *
Content-Length: 6584528
Content-Md5: RpfskSSCIEXm7I9lGuMsBA==
Content-Type: audio/mpeg
Date: Wed, 17 Apr 2019 14:27:05 GMT
ETag: "4697ec9124822045e6ec8f651ae32c04"
last-modified: Wed, 17 Apr 2019 14:24:23 GMT
Server: BaseHTTP/0.3 Python/2.7.15
```

Second call, with a partial content,

Request,
```
Request URL: http://localstack:4572/local-bucket/test.mp3?X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Security-Token=xxx%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=xxx%2F20190416%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20190416T150211Z&X-Amz-SignedHeaders=host&X-Amz-Expires=172800&X-Amz-Signature=xxx
Request Method: GET
Status Code: 206 Partial Content
Remote Address: xx.xx.xx.xx:4572
Referrer Policy: no-referrer-when-downgrade
```

Response,
```
Access-Control-Allow-Headers: authorization,content-type,content-md5,cache-control,x-amz-content-sha256,x-amz-date,x-amz-security-token,x-amz-user-agent
Access-Control-Allow-Methods: HEAD,GET,PUT,POST,DELETE,OPTIONS,PATCH
Access-Control-Allow-Origin: *
Content-Length: 6584528
Content-Range: bytes 0-6584527/6584528
Content-Type: text/html; charset=utf-8
Date: Wed, 17 Apr 2019 14:27:05 GMT
Server: BaseHTTP/0.3 Python/2.7.15
```

Here, we are getting Content-Type: text/html and this causes the CORB problem.

Trying the same from a real S3 service:

First call,

Request,

```
Request URL: https://xxx.s3.amazonaws.com/xxx.mp3
Request Method: GET
Status Code: 304 Not Modified
Remote Address: xx.xx.xx.xx:443
Referrer Policy: no-referrer-when-downgrade
```

Response,

```
Date: Wed, 17 Apr 2019 14:34:37 GMT
ETag: "5d79d70934b79a527383c87a7d22dc3a"
Last-Modified: Wed, 17 Apr 2019 10:21:17 GMT
Server: AmazonS3
x-amz-id-2: 1tX9Ni8GfNVZNBrK7KtdamP+6fxeoTIo0pMzLlLMGiIoAGEM3qpm12UoPktkjDxLiLWj16v2hbo=
x-amz-meta-gid: 33
x-amz-meta-mode: 33277
x-amz-meta-mtime: 1555496476
x-amz-meta-uid: 33
x-amz-request-id: 9AA70366CB6D9C73
x-amz-version-id: null
```

Second call, with partial content,

Request,

```
Request URL: https://xxx.s3.amazonaws.com/xxx.mp3
Request Method: GET
Status Code: 206 Partial Content
Remote Address: xx.xx.xx.xx:443
Referrer Policy: no-referrer-when-downgrade
```

Response,

```
Accept-Ranges: bytes
Content-Length: 5952573
Content-Range: bytes 0-5952572/5952573
Content-Type: audio/mpeg
Date: Wed, 17 Apr 2019 14:34:37 GMT
ETag: "5d79d70934b79a527383c87a7d22dc3a"
Last-Modified: Wed, 17 Apr 2019 10:21:17 GMT
Server: AmazonS3
x-amz-id-2: xxx
x-amz-meta-gid: 33
x-amz-meta-mode: 33277
x-amz-meta-mtime: 1555496476
x-amz-meta-uid: 33
x-amz-request-id: 9AA70366CB6D9C73
x-amz-version-id: null
```

In summary, when a partial content request is made it is always served as text/html and this generates the CORB problem.

We also try to set a CORS policy including `X-Content-Type-Options: nosniff` header via ExposeHeaders in order to prevent CORB check but the service doesn't allow this header.

We believe that the solution could be to send the correct `Content-Type` header or in case this is impossible, always include the `X-Content-Type-Options: nosniff` header in all the responses of the S3 service.
bucket_name = 'test-bucket-%s' % short_uid()
        self.s3_client.create_bucket(Bucket=bucket_name)
        self.s3_client.put_object(Bucket=bucket_name, Key='error.html', Body='This is the error document')
        self.s3_client.put_bucket_website(
            Bucket=bucket_name,
            WebsiteConfiguration={'ErrorDocument': {'Key': 'error.html'}}
        )
        url = self.s3_client.generate_presigned_url(
            'get_object', Params={'Bucket': bucket_name, 'Key': 'nonexistent'}
        )
        response = requests.get(url, verify=False)
        self.assertEqual(response.status_code, 200)
        self.assertEqual(response.text, 'This is the error document')