RFC 2616 doesn’t specify whether a message-body is needed or not, which I interpret as being optional. Is there any practical danger in omitting a message body?
For example, are there bugs (or features) in certain browsers that are triggered by a blank message body in a 302?
It’s not needed. The RFC9110 spec on 302 however doesn’t forbid it as well.
Note that it does forbid the message body for certain statuses, such as 204 and 304.
If the same were true for 302, then it should surely have been explicitly mentioned.
As far as I know, all modern browsers ignore the message body of a 302 in response to a GET or POST and will directly go to the URL as specified in
Locationheader.