I have created an app that uses GET requests as well as POST requests. The requests are performed as part of custom functionality added within module functions as well as service endpoints. All works well, but when publishing the app live (with anonymous mode activated) the POST requests no longer get executed except if a user session is active. So, from my observation the application works in live mode for unauthenticated users, but the POST requests only work for authenticated users.
Is there a functional limitation I should be aware of or are there some more VBCS publish settings that are required?