I'm trying to protect some video files behind a PHP script, because I need to rename them on the fly, otherwise I'd stick with mod_secdownload. My problem is that although I don't set any Content-Type header from PHP, it always ends up being "text/html" instead of the correct type which is configured in lighttpd.
It seems like lighttpd should be able to properly set that header since I see that it properly sets the Content-Length header already.
I also noticed that I could force the Content-Type to something else from the PHP script, so maybe it's PHP defaulting to text/html and lighttpd not wanting to overwrite it? Still, I'm not sure which behavior makes more sense... either way, some mean to force the Content-Type of a file sent by X-LIGHTTPD-send-file to be the mime type configured in lighttpd would seem to make sense to me.