Upgrade from 3.3.6 to 3.3.7 leads to 405 for OPTIONS request on /

[BacLuc]

API Platform version(s) affected: 3.3.7

Description
After the upgrade of api-platform from 3.3.6 to 3.3.7, our test
https://github.com/ecamp/ecamp3/blob/3cd279fd1c1367287ea989f38f7238f93026e4b4/api/tests/Api/RootTest.php
fails.

It returns the following:

Failed asserting that the Response status code is 200.
HTTP/1.1 405 Method Not Allowed
Allow:                  GET, HEAD

The PR is here:

• fix(deps): update dependency api-platform/core to v3.3.7 ecamp/ecamp3#5480

The header with Allow: makes sense, but i would expect that api-platform returns a 2x status code for the OPTIONS request.
(And that this behaviour does not change in a bugfix update).
Or do we need to allow OPTIONS Requests explicitly for all routes?

How to reproduce
See the test

Possible Solution
I did not see which change between 3.3.6 and 3.3.7 might have caused this.
Either update the Changelog or change the behaviour back.

Additional Context

[soyuka]

is it this change? #6437 should we add OPTIONS as well?

[BacLuc]

Ah, does this change only allow GET and HEAD for /, /docs etc?
Then this may be it.
ui, preflight requests won't like that...

[dunglas]

If I'm not mistaken, OPTIONS requests should be handled by NelmioCorsBundle or the server web directly.

Maybe do we need to update the default Nelmio config?

[BacLuc]

It seems you have now to send the correct headers that it is a preflight request.
So it is not urgend, preflight requests still work.

When i find time i will try to find out why this is now required.
But for now the next who runs into this issue hopefully finds this, and sees this solution:

public function testOptionsWhenNotLoggedIn() {
        static::createBasicClient()->request(
            'OPTIONS',
            '/',
            [
                'headers' => [
                    'Origin' => 'http://localhost:3000',
                    'Access-Control-Request-Method' => 'GET',
                    'Access-Control-Request-Headers' => 'Origin, Content-Type, Accept, Authorization'
                ]
            ]
        );
        $this->assertResponseStatusCodeSame(200);
    }

[BacLuc]

I added a test to the api-platform/demo repo.
I think this is enough for now.
Thanks for the help.