I'm currently using zapworks studio to create an AR experience. This involves using Z.ajax for ajax calls, including GET and POST requests. For hosting couchdb, I've opted for smileupps due to their free hosting service. The CORS configuration is as follows:

credentials: false; headers:Accept, Authorization, Content-Type, Origin; methods: GET,POST,PUT,DELETE,OPTIONS,HEAD; origins: *

While everything functions smoothly on Windows when launching ZapWorks Studio, the problem arises when trying to make a POST ajax call after scanning the zapcode with an Android device. It seems to be connected to using basic authentication, allowing only admin access. Despite being able to manage the database directly from both desktop and phone browsers, the issue persists.

Various attempts have been made to resolve this, such as removing authentication and adjusting CORS configurations, all to no avail. Although initially thought to be a CORS-related complication, it's peculiar that while things run smoothly on Windows, the POST request consistently fails on mobile devices, displaying status code 0.

UPDATE - Testing on apitester shows successful outcomes both on desktop and mobile versions.

UPDATE - To provide further insight, here's the zpp file demonstrating the logic: ZPP File

UPDATE - Trying the REST Api Client app on my phone also yielded success. This points towards a potential CORS or ZapWorks-related issue as it seamlessly operates on Windows but encounters problems on mobile platforms.

UPDATE - While identifying the root of the problem, resolving it remains puzzling. Setting up a proxy for debugging requests from ZapWorks Studio seemed to shed light on the matter, revealing a preflight request issue resulting in a "HTTP/1.1 405 Method Not Allowed" response despite indicating that POST method should be allowed.

The provided request details reveal the attempt and subsequent feedback:

OPTIONS /ranking HTTP/1.1
Host: somehost.com
Connection: keep-alive
Access-Control-Request-Method: POST
Origin: null
User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G950U1 Build/R16NW; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/67.0.3396.87 Mobile Safari/537.36
Access-Control-Request-Headers: authorization,content-type,x-requested-with
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US
X-Requested-With: com.zappar.Zappar

The encountered response read as follows:

HTTP/1.1 405 Method Not Allowed
Server: CouchDB/1.6.0 (Erlang OTP/R15B01)
Date: Mon, 18 Jun 2018 21:22:12 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 76
Cache-Control: must-revalidate
Allow: DELETE,GET,HEAD,POST
Access-Control-Expose-Headers: Cache-Control, Content-Type, Server
Access-Control-Allow-Origin: null
Connection: keep-alive

{"error":"method_not_allowed","reason":"Only DELETE,GET,HEAD,POST allowed"}

Intriguingly, although POST permission is clearly stated, the situation remains unresolved...

The absence of a preflight request on the Windows front hints at why the process succeeds there, unlike on mobile devices. The current challenge lies in configuring CORS on couchdb to accommodate Android operations effectively. Available settings include:

enable_cors: true
credentials: false
headers:Accept, Authorization, Content-Type, Origin
methods:GET,POST,PUT,DELETE,OPTIONS,HEAD
origins:*

Provided below is the relevant code snippet:

const Open_SansRegular_ttf0 = symbol.nodes.Open_SansRegular_ttf0;

parent.on("ready", () => {
    const Plane0 = symbol.nodes.Plane0;

    let ajaxParameters : Z.Ajax.Parameters = {
        url: "https://something.smileupps.com/test/_all_docs?include_docs=true",
        headers: {"Authorization": "Basic my64encoding"},
        method: "GET",
        timeout: 3000
    };

    // Executing AJAX request
    Z.ajax(ajaxParameters, (statusCode, data, request) => {checkRequest(statusCode, data);});

    ajaxParameters = {
        url: "https://something.smileupps.com/test",
        headers: {"Content-Type":"application/json", "Authorization": "Basic my64encoding"},
        method: "POST",
        body: '{"name" : "asdasd", "something": 234}',
        timeout: 3000
    };

    Z.ajax(ajaxParameters, (statusCode, data, request) => {checkRequest(statusCode, data);});
});

function checkRequest(statusCode, data) {
    if (statusCode === 0) {
        Open_SansRegular_ttf0.text("Unable to connect - check network connection.");
        console.log("Unable to connect - check network connection.");
        return;
    }

    if (statusCode < 200 || statusCode >= 300) {
        Open_SansRegular_ttf0.text("HTTP request failed: " + statusCode);
        console.log("HTTP request failed: " + statusCode);
        return;
    }

    let parsedData;
    try {
        parsedData = JSON.parse(data);
    } catch (e) {
        Open_SansRegular_ttf0.text("Unable to parse JSON: " + e);
        console.log("Unable to parse JSON: " + e);
        return;
    }

    return parsedData;
}

UPDATEResponding to requests under Windows:

Accept:*/*
Accept-Encoding:gzip, deflate
Accept-Language:en-US
Authorization:Basic mybase64encoding
Connection:keep-alive
Content-Length:37
Content-Type:application/json
Host:http://something.smileupps.com/test
Origin:file://
User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) ZapWorksStudio/4.0.4-stable Chrome/58.0.3029.110 Electron/1.7.9 Safari/537.36
X-DevTools-Request-Id:3680.9
X-Requested-With:XMLHttpRequest

and the corresponding response:

Access-Control-Allow-Origin:file://
Access-Control-Expose-Headers:Cache-Control, Content-Type, ETag, Server
Cache-Control:must-revalidate
Content-Length:95
Content-Type:text/plain; charset=utf-8
Date:Mon, 18 Jun 2018 21:36:22 GMT
ETag:"1-512f89feb3d0a88781119e772ec6fd7b"
Location:http://something.smileupps.com/test
Server:CouchDB/1.6.0 (Erlang OTP/R15B01)

No preflight mechanism detected.