(aws-apigateway) MockIntegrations with defaulCorsPreflightOptions return statusCode 500

[Molaire]

What is the problem?

If an API Gateway Resource allow CORS with defaultCorsPreflightOptions in its options, hitting its child methods that are MockIntegrations will fail with a Internal Error message (statusCode: 500)

This can be manually fixed by setting PassthroughBehavior.NEVER for the Integration request in CDK or the console.

Reproduction Steps

import {
    MockIntegration,
    PassthroughBehavior,
    RestApi,
} from "aws-cdk-lib/aws-apigateway";

const restApi = new RestApi(this, "testApi", {
  defaultCorsPreflightOptions: {
              allowOrigins: Cors.ALL_ORIGINS
          }
    })

const mockIntegration = new MockIntegration({
          integrationResponses: [{
              statusCode: '200',
              responseTemplates: {
                  'application/json': '{"abc": "dfg"}'
              }
          }],
          passthroughBehavior: PassthroughBehavior.NEVER,
          requestTemplates: {
              'application/json': '{ "statusCode": 200 }',
          },
      })

restApi.addMethod(
          "GET",
          mockIntegration,
          {
              methodResponses: [
                  { statusCode: '200' }
              ]
          });

What did you expect to happen?

I expected MockIntegration methods to work beside the LambdaIntegration methods, even with CORS enabled by default.

What actually happened?

Only the LambdaIntegration works, not the MockIntegration methods.
They work when testing through the API Gateway test option in the console, but not when hitting them with my browser, implying it's a problem with CORS/OPTIONS.

CDK CLI Version

2.4.0 (build 993f14d)

Framework Version

No response

Node.js Version

v16.13.1

OS

Ubuntu 21.10

Language

Typescript

Language Version

No response

Other information

A workaround is to set defaultCorsPreflightOptions to undefined for the resources with MockIntegration and manually add the method OPTIONS with passthroughBehavior: PassthroughBehavior.NEVER.

[peterwoodworth]

Hey @Molaire,

This doesn't seem to be an issue with the CDK, but rather CloudFormation or API Gateway. Do you find the same behavior when using the console?

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[takeshixx]

@peterwoodworth the issue is that passthroughBehavior is not set to NEVER. However, CloudFormation and API Gateway do not have any defaults regarding CORS. So I would argue that CDK is responsible to ensure that the CORS preflight request is handled properly.

I suggest to just set passthroughBehavior to NEVER by default. I have submitted a PR but that is currently blocked because it introduces breaking changes to the API Gateway integration tests.