Inline JavaScript – either reflected or stored – means that improperly escaped user-inputs can generate code that is interpreted by the web browser as JavaScript. By using CSP to disable inline JavaScript, you can effectively eliminate almost all XSS attacks against your site.
Data URIs - 302 Found - HTTP | MDN - MDN Web Docs
It's a redirection, not an error. RFC2616 describes it as indicating:
The requested resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client SHOULD continue to use the Request-URI for future requests.
Note that you should only use HTTP 302 redirects for temporary redirections, not permanent ones. Permanent redirections should be implemented using an HTTP 301, instead.
You can avoid it by not issuing an HTTP 302 redirect in your code.
Find more information in the Wikipedia article, and in the answers to this related question.
Status 301 means that the resource (page) is moved permanently to a new location. The client/browser should not attempt to request the original location but use the new location from now on.
Status 302 means that the resource is temporarily located somewhere else, and the client/browser should continue requesting the original url.
The 302 status code indicates that the resource you are requesting has redirected to another resource. If this is behind some authentication, or requiring a session to be active then yes, it would follow that the session timing out is responsible for the ajax resource being called to redirect to possibly a login screen maybe.
I would seriously recommend using something like Charles or Fiddler to track the requests being made.
302 is a status code returned by the server to indicate that the client should retry the request using a different URL. It's a way to redirect the client to a different endpoint.
The problem is that only (or GET) requests can be retried automatically. You are using a HEAD.POST
If the 302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued.
A well-behaved API should probably not issue 30X in response to a POST, but it is. The way to get around this is to make a new http request with the redirected URL. (You might want to put it in a loop to keep following the redirects until you get to 200, or some error, or reach a timeout/limit.)while