HTTP call using DELETE fails on iOS, succeeds on Android

Question

I'm calling an API from a Cordova (Monaca) app using Vue.js. The code is platform-agnostic and works well with Android and the browser preview. The relevant part just calls this.$http.delete(url, config) and logs the response. this.$http comes from https://github.com/pagekit/vue-resource.

On iOS, I'm getting this when I log the response:

{
  "url": "https://domain.whatever?KEY=12345&receipt_id=12345",
  "ok": false,
  "status": 0,
  "statusText": "",
  "headers": {
    "map": {
      "": [
        ""
      ]
    }
  },
  "body": "",
  "bodyText": ""
}

The same call, on Android, gets this result:

{
  "url": "https://domain.whatever?KEY=12345&receipt_id=12345",
  "ok": true,
  "status": 200,
  "statusText": "OK",
  "headers": {
    "map": {
      "connection": [
        "Keep-Alive"
      ],
      "content-encoding": [
        "gzip"
      ],
      "content-length": [
        "17"
      ],
      "content-type": [
        "application/json"
      ],
      "date": [
        "Mon, 12 Apr 2021 12:51:56 GMT"
      ],
      "keep-alive": [
        "timeout=5, max=100"
      ],
      "server": [
        "Apache"
      ],
      "vary": [
        "Accept-Encoding"
      ]
    }
  },
  "body": {
    "status": "OK"
  },
  "bodyText": "{\"status\": \"OK\"}"
}

(Logs are slightly edited to remove private data and indented for readability.)

What can explain the failure with iOS? Is there some kind of default filter applied by iOS to block HTTP DELETE requests? POST and GET requests seem to behave consistently across mobile platforms.

Answer 1

By default iOS blocks unsecure HTTP requests:

https://developer.apple.com/documentation/security/preventing_insecure_network_connections

Check the Configure Exceptions Only When Needed; Prefer Server Fixes section to see how you add override this behavior.