2026-11-06 UTC
# 
Zegnat I do not think it needs any extra validation rules, upon a first read. The real bug is simply "it's using the original http URL to resolve the URL." If it is resolving relative URLs, those should be resolved against whatever the resource is that was retrieved. And that resource is post-redirects.