Within an application environment, a URL is being called via AJAX four times. Interestingly, on a specific page, the AJAX request gets canceled when attempting the fourth invocation.
The fourth request shows "Provisional headers are shown" in its request headers, and inexplicably, a fifth request (similar to the fourth) is triggered externally (not by the application).
https://i.sstatic.net/UMDpF.png
Through a detailed investigation using chrome://net-internals, I investigated the third and fourth requests and noticed significant differences in the HTTP_TRANSACTION_READ_HEADERS section of the network log.
Here is the complete data of the fourth request, which unexpectedly receives a 302 response unlike the previous three requests -
t=61558 [st= 0] +REQUEST_ALIVE [dt=274]
--> priority = "MEDIUM"
--> url = "https://example.com/api/v1/track/login?time=1556662845627"
t=61559 [st= 1] NETWORK_DELEGATE_BEFORE_URL_REQUEST [dt=0]
t=61559 [st= 1] +URL_REQUEST_START_JOB [dt=273]
--> load_flags = 0 (NORMAL)
--> method = "POST"
--> privacy_mode = 0
--> upload_id = "0"
--> url = "https://example.com/api/v1/track/login?time=1556662845627"
...
...
Here is the full data of the third request for comparison -
t=61346 [st= 0] +REQUEST_ALIVE [dt=97]
--> priority = "MEDIUM"
--> url = "https://test.undostres.com.mx/api/v1/track/login?time=1556662845405"
t=61346 [st= 0] NETWORK_DELEGATE_BEFORE_URL_REQUEST [dt=0]
t=61346 [st= 0] +URL_REQUEST_START_JOB [dt=97]
--> load_flags = 0 (NORMAL)
--> method = "POST"
--> privacy_mode = 0
--> upload_id = "0"
--> url = "https://test.undostres.com.mx/api/v1/track/login?time=1556662845405"
...
...
While troubleshooting, a potential solution was found using the following code -
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
Despite this resolution, it may not seem logical.
PS - Attached are some server logs. Notably, the same API begins returning a 302 status code after a number of attempts. Additionally, a similar issue is discussed here but did not provide a solution.
189.213.84.17 - - [30/Apr/2019:22:19:31 -0500] "POST /api/v1/track/login?time=1556680771692 HTTP/1.1" 200 1316 "https://example.com/index.php" ...
189.213.84.17 - - [30/Apr/2019:22:19:32 -0500] "POST /api/v1/track/login?time=1556680772165 HTTP/1.1" 200 1316 "https://example.com/index.php" ...
189.213.84.17 - - [30/Apr/2019:22:19:32 -0500] "POST /api/v1/track/login?time=1556680772167 HTTP/1.1" 200 1316 "https://example.com/index.php" ...
189.213.84.17 - - [30/Apr/2019:22:19:32 -0500] "POST /api/v1/track/login?time=1556680772393 HTTP/1.1" 302 1534 "https://example.com/index.php" ...