Motivation

When deploying a CDK stack with an APIGW REST API with "automatic" CORS management by APIGW, CDK will create an OPTIONS method with a MOCK integration. The problem is that this integration has a request template equal to "application/json": "{statusCode: 200}", which is invalid JSON.

From the documentation, nothing lets you think that invalid JSON would be accepted, as it needs the statusCode field.
But it does, they don't JSON parse but use a custom token parser that we're tried to test the limit off. We're settling now on this basic implementation which still has flaws, but cover quite some ground already, as shown by the unit tests. We also updated an integration test to specifically cover the request template CDK was using.

This custom parser will only be executed if the MOCK integration does not return valid JSON, meaning every existing use case will still work, and only people with very, very esoteric negative testing might be impacted by this new custom parser accepting data AWS wouldn't (but we already covered most of the bad negative cases).

Changes

• create a small (bad) parser to try to get and validate the status code from MOCK integration
• add a unit test with some weird cases
• update an integration test for the CDK use-case