ok, after some digging I manage to fix it with following middleware configuration. However it now returns octet-stream for all JSON responses, is there a way to fix it? I also would be grateful for some kind of explanation of what's going on here (I realize it's because wrap-content middleware but I don't get why Ring strip content-type header from static content if I omit it - so how can I have both?)

(def app
  (api
   (assoc api-config
          :middleware
          [[wrap-cors :access-control-allow-origin [#"\\*"] :access-control-allow-methods [:get :post :put :delete :patch]]
           wrap-reload
           [wrap-defaults (-> site-defaults
                              (assoc-in [:responses :not-modified-responses] true)
                              (assoc-in [:static :resources] resources-root)
                              (assoc-in [:security :anti-forgery] false)
                              (assoc-in [:security :frame-options] :deny)
                              (assoc-in [:security :ssl-redirect] (not (:dev env)))
                              (assoc-in [:security :hsts] (not (:dev env))))]])