Do not allow Go standard lib to sniff Content-Type header

modules/caddyhttp/fileserver/staticfiles.go

@@ -185,7 +185,10 @@ func (fsrv *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) error
 
 	// TODO: Etag
 
-	// TODO: Disable content-type sniffing by setting a content-type...
+	// do not allow Go to sniff the content-type
+	if w.Header().Get("Content-Type") == "" {
+		w.Header()["Content-Type"] = nil
+	}
 
 	// let the standard library do what it does best; note, however,
 	// that errors generated by ServeContent are written immediately

modules/caddyhttp/staticresp.go

@@ -39,6 +39,11 @@ func (s Static) ServeHTTP(w http.ResponseWriter, r *http.Request) error {
 		w.Header()[field] = vals
 	}
 
+	// do not allow Go to sniff the content-type
+	if w.Header().Get("Content-Type") == "" {
+		w.Header()["Content-Type"] = nil
+	}
+
 	// get the status code
 	statusCode := s.StatusCode
 	if statusCode == 0 && s.StatusCodeStr != "" {