Q:

AJAX failing in Android using Cordova

I have been trying hard to make AJAX calls to my node.js server with no success.
I have done the following:
1) Installed the cors package in my node.js server. AJAX did work in the browser.
2) Added the following Content Security Policy to index.html:
<meta http-equiv="Content-Security-Policy" content="default-src * data: gap: https://ssl.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://maps.googleapis.com https://163.172.175.135">

3) Added a few lines to my config.xml:
<?xml version='1.0' encoding='utf-8'?>
<widget id="roda.X.XXXX" version="1.0.0" xmlns="http://www.w3.org/ns/widgets" xmlns:cdv="http://cordova.apache.org/ns/1.0">
    <name>Roda</name>
    <description>
        A sample Apache Cordova application that responds to the deviceready event.
    </description>
    <author email="dev@cordova.apache.org" href="http://cordova.io">
        Apache Cordova Team
    </author>
    <content src="index.html" />
    <access origin="*" />
    <allow-navigation href="*" />
    <allow-intent href="*" />
    <allow-intent href="http://*/*" />
    <allow-intent href="https://*/*" />
    <allow-intent href="tel:*" />
    <allow-intent href="sms:*" />
    <allow-intent href="mailto:*" />
    <allow-intent href="geo:*" />
    <platform name="android">
        <allow-intent href="market:*" />
    </platform>
    <platform name="ios">
        <allow-intent href="itms:*" />
        <allow-intent href="itms-apps:*" />
    </platform>
    <engine name="android" spec="^6.2.3" />
    <engine name="browser" spec="^4.1.0" />
    <plugin name="cordova-plugin-geolocation" spec="^2.4.3" />
    <plugin name="cordova-plugin-whitelist" spec="^1.3.2" />
</widget>

What have I missed?

A:

I later found out that AJAX would work in debug mode, but not in release mode. The problem was that I was using the IP address instead of the domain name to connect to the server, thus failing SSL verification. In debug mode, SSL certificates are not verified.
Phew. Problem solved!

