fix(apigateway): set passthrough behavior to avoid errors on CORS preflight requests

[takeshixx]

Set passthroughBehavior behavior to NEVER to prevent errors for CORS preflight requests with content-types other than application/json.

Issue # (if applicable)

This was reported as #18297, but it was closed without a fix.

Reason for this change

Using addCorsPreflight() will add a mock integration for OPTIONS requests and maps them to content-type application/json. OPTIONS requests with a content-type header other than application/json lead to HTTP 500 Internal Server Errors.

Description of changes

Setting the passthroughBehavior to NEVER returns a mime type error instead of a internal server error, which is the appropriate response.

It should be noted that this setting was proposed in the initial implementation of addCorsPreflight() in #906 already. However, it looks like it didn't make it into the CDK. Instead the default configuration is use, which sets it to WHEN_NO_MATCH.

Description of how you validated changes

I tested the change by manually overriding the passthroughBehavior on the LambdaRestApi resource:

lambdaRestApi.methods
      .filter((m) => m.httpMethod === 'OPTIONS')
      .forEach((om) => {
        om.node.children.forEach((c) => {
          const mm = c as apigw.CfnMethod;
          mm.addOverride('Properties.Integration.PassthroughBehavior', apigw.PassthroughBehavior.NEVER);
        });
      });

Checklist

• [X] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 9956a62f76c8ad7a360f7c160ed12cc084d9d26e
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[sumupitchayan]

@takeshixx can you take a look at the build logs to see why it's failing?

[takeshixx]

I talked to @paulhcsun, it seems to be the breaking changes to API Gateway. I mentioned it in #18297 as well. The reason is that it affects every call to addCorsPreflight().