Repository: traefik/traefik (language: go)

Issue:
traefik 3 dashboard
### Welcome!

- [X] Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
- [X] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.

### What did you do?

i updated traefik in my compose file to test traefik:3.0

i went on this url https://traefik.exemple.com/dashboard/
and instead of showing the webpage, it showed me html.
it may be related to the fact that content type is not automatic anymore.




### What did you see instead?

i got raw html in the browser

```html
<!DOCTYPE html><html><head><title>Traefik</title><meta charset=utf-8><meta name=description content="Traefik UI"><meta name=format-detection content="telephone=no"><meta name=msapplication-tap-highlight content=no><meta name=viewport content="user-scalable=no,initial-scale=1,maximum-scale=1,minimum-scale=1,width=device-width"><link rel=icon type=image/png href=statics/app-logo-128x128.png><link rel=icon type=image/png sizes=16x16 href=statics/icons/favicon-16x16.png><link rel=icon type=image/png sizes=32x32 href=statics/icons/favicon-32x32.png><link rel=icon type=image/png sizes=96x96 href=statics/icons/favicon-96x96.png><link rel=icon type=image/ico href=statics/icons/favicon.ico><link rel=apple-touch-icon href=statics/icons/apple-icon-152x152.png><link rel=apple-touch-icon sizes=152x152 href=statics/icons/apple-icon-152x152.png><link rel=apple-touch-icon sizes=167x167 href=statics/icons/apple-icon-167x167.png><link rel=apple-touch-icon sizes=180x180 href=statics/icons/apple-icon-180x180.png><link href=css/041f4ca8.f6e3d404.css rel=prefetch><link href=css/067758be.3de973dd.css rel=prefetch><link href=css/09354cb8.0e433876.css rel=prefetch><link href=css/11f98cd8.02647ec3.css rel=prefetch><link href=css/29ab06d1.ec33fe24.css rel=prefetch><link href=css/3e3ce03c.9b22e80f.css rel=prefetch><link href=css/46fd955e.9b22e80f.css rel=prefetch><link href=css/491024e9.9b22e80f.css rel=prefetch><link href=css/52875482.9b22e80f.css rel=prefetch><link href=css/54b4dbdf.6e23d447.css rel=prefetch><link href=css/6d73c73c.9b22e80f.css rel=prefetch><link href=css/77d911b4.9b22e80f.css rel=prefetch><link href=css/797e4f23.9b22e80f.css rel=prefetch><link href=css/8f7f08e2.00435ec2.css rel=prefetch><link href=css/b34404c8.9b22e80f.css rel=prefetch><link href=css/e036c7dc.1666b9a0.css rel=prefetch><link href=js/041f4ca8.4f70d06d.js rel=prefetch><link href=js/067758be.c7890581.js rel=prefetch><link href=js/09354cb8.2e39e534.js rel=prefetch><link href=js/11f98cd8.e511840d.js rel=prefetch><link href=js/29ab06d1.8f1fa71a.js rel=prefetch><link href=js/2d21e8fd.c00ac0e6.js rel=prefetch><link href=js/3e3ce03c.293f4729.js rel=prefetch><link href=js/46fd955e.343a8488.js rel=prefetch><link href=js/491024e9.5ba4955c.js rel=prefetch><link href=js/52875482.65e645a6.js rel=prefetch><link href=js/54b4dbdf.915c5773.js rel=prefetch><link href=js/6d73c73c.d8a27bbb.js rel=prefetch><link href=js/77d911b4.8d5002b7.js rel=prefetch><link href=js/797e4f23.771f63ae.js rel=prefetch><link href=js/8f7f08e2.25fcd761.js rel=prefetch><link href=js/b34404c8.7a4b9be8.js rel=prefetch><link href=js/e036c7dc.5d7ae0bf.js rel=prefetch><link href=css/app.3d2d5994.css rel=preload as=style><link href=js/app.9eeba0cd.js rel=preload as=script><link href=js/runtime.fee3a4ea.js rel=preload as=script><link href=js/vendor.f60bcb86.js rel=preload as=script><link href=css/app.3d2d5994.css rel=stylesheet></head><body><div id=q-app></div><script type=text/javascript src=js/app.9eeba0cd.js></script><script type=text/javascript src=js/runtime.fee3a4ea.js></script><script type=text/javascript src=js/vendor.f60bcb86.js></script></body></html>
```

### What version of Traefik are you using?

Version:      3.0.0-beta2
Codename:     beaufort
Go version:   go1.19.4
Built:        2022-12-07T16:32:34Z
OS/Arch:      linux/amd64

### What is your environment & configuration?

```yaml
    traefik:
        image: traefik:3.0
        container_name: traefik
        restart: always
        command:
            - --entrypoints.websecure.address=:443
            - --entrypoints.web.address=:80
            - --providers.docker.exposedByDefault=false
            - --providers.docker=true
            - --api
            - --ping
            - --ping.manualrouting=true
            - --ping.entryPoint=websecure
        labels:
            - "traefik.enable=true"

            # api secure
            - "traefik.http.routers.traefik.rule=Host(`traefik.${DOMAIN}`)"
            - "traefik.http.routers.traefik.service=api@internal"
            - "traefik.http.routers.traefik.tls.certresolver=wildcardle"
            - "traefik.http.routers.traefik.entrypoints=websecure"

            # ping secure
            - "traefik.http.routers.ping.rule=Host(`traefik.${DOMAIN}`) && PathPrefix(`/ping`)"
            - "traefik.http.routers.ping.service=ping@internal"
            - "traefik.http.routers.ping.tls.certresolver=wildcardle"
            - "traefik.http.routers.ping.entrypoints=websecure"

        ports:
            - "80:80"
            - "443:443"

        volumes:
            - "/var/run/docker.sock:/var/run/docker.sock:ro"
            - "./traefik:/traefik"
```


### If applicable, please paste the log output in DEBUG level

_No response_


Discussion / hints:
Hello,

I tried to reproduce it, I tried with several browsers (Firefox, Chrome), and I'm not able to reproduce the problem.

What is your browser?
Can you try with another browser?

Thanks for your reply. I use chrome.

My bad : the minimal reproducible case was not complete enough
In fact, i had set a middleware on the api endpoint like so :

```
- "traefik.http.routers.traefik.middlewares=securityheaders,admin"
```

When i remove the securityheaders middleware it works.
And if i add it, the endpoint returns raw html.

This is the securityheaders middleware (which should only force some headers values) :
```
- "traefik.http.middlewares.securityheaders.headers.referrerPolicy=strict-origin-when-cross-origin"
- "traefik.http.middlewares.securityheaders.headers.framedeny=true"
- "traefik.http.middlewares.securityheaders.headers.customFrameOptionsValue=sameorigin"
- "traefik.http.middlewares.securityheaders.headers.customResponseHeaders.X-XSS-Protection=0"
- "traefik.http.middlewares.securityheaders.headers.ContentTypeNosniff=true"
- "traefik.http.middlewares.securityheaders.headers.ForceSTSHeader=true"
- "traefik.http.middlewares.securityheaders.headers.STSIncludeSubdomains=true"
- "traefik.http.middlewares.securityheaders.headers.STSPreload=true"
- "traefik.http.middlewares.securityheaders.headers.STSSeconds=315360000"
- "traefik.http.middlewares.securityheaders.headers.customResponseHeaders.x-powered-by="
- "traefik.http.middlewares.securityheaders.headers.customResponseHeaders.Server="
- "traefik.http.middlewares.securityheaders.headers.customResponseHeaders.X-Download-Options=noopen"
- "traefik.http.middlewares.securityheaders.headers.customResponseHeaders.X-DNS-Prefetch-Control=off"
- "traefik.http.middlewares.securityheaders.headers.customResponseHeaders.X-Permitted-Cross-Domain-Policies=none"
```


The problem is related to `- "traefik.http.middlewares.securityheaders.headers.ContentTypeNosniff=true"`

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options

Fix patch:
diff --git a/pkg/api/dashboard/dashboard.go b/pkg/api/dashboard/dashboard.go
index ebcaf315e2..49f531f232 100644
--- a/pkg/api/dashboard/dashboard.go
+++ b/pkg/api/dashboard/dashboard.go
@@ -34,6 +34,11 @@ func Append(router *mux.Router, customAssets fs.FS) {
 			// allow iframes from our domains only
 			// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src
 			w.Header().Set("Content-Security-Policy", "frame-src 'self' https://traefik.io https://*.traefik.io;")
+
+			// The content type must be guessed by the file server.
+			// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+			w.Header().Del("Content-Type")
+
 			http.StripPrefix("/dashboard/", http.FileServer(http.FS(assets))).ServeHTTP(w, r)
 		})
 }


Test patch: