This redirects are ignored because of the IAM redirect pattern. Relevant code. validator.go:16 invalidRedirectRegex = regexp.MustCompile(`^[/\\](?:[\s\v]*|\.{1,2})[/\\]`) %68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d /<>//example.com /?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com /?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redirect_uri=/\/example.com /?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com /%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d /ReceiveAutoRedirect/false?desiredLocationUrl=http://xssposed.org /http://%67%6f%6f%67%6c%65%2e%63%6f%6d /http://example.com /http://google.com /http://localdomain.pw /https:/%5cexample.com/ /https:/%5cgoogle.com/ /https:/%5clocaldomain.pw/ /https://%09/example.com /https://%5cexample.com /https://%5cexample.com@google.com /https://%5cgoogle.com /https://%5clocaldomain.pw /https://%5cwww.whitelisteddomain.tld@google.com /https://%5cwww.whitelisteddomain.tld@localdomain.pw /https:///example.com/%2e%2e /https:///example.com/%2f%2e%2e /https:///example.com@google.com/%2f%2e%2e /https:///google.com/%2f%2e%2e /https:///localdomain.pw/%2f%2e%2e /https:///www.google.com/%2f%2e%2e /https:///www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e /https:///www.whitelisteddomain.tld@www.google.com/%2f%2e%2e /https://example.com /https://example.com/ /https://example.com/%2e%2e /https://example.com/%2e%2e%2f /https://example.com/%2f%2e%2e /https://example.com/%2f.. /https://example.com// /https://example.com@google.com/ /https://example.com@google.com/%2e%2e /https://example.com@google.com/%2f%2e%2e /https://example.com@google.com/%2f.. /https://google.com/ /https://google.com/%2e%2e /https://google.com/%2f%2e%2e /https://google.com/%2f.. /https://localdomain.pw/ /https://localdomain.pw/%2e%2e /https://localdomain.pw/%2f%2e%2e /https://localdomain.pw/%2f.. /https://www.google.com/%2e%2e /https://www.google.com/%2f%2e%2e /https://www.whitelisteddomain.tld@google.com/ /https://www.whitelisteddomain.tld@google.com/%2f.. /https://www.whitelisteddomain.tld@localdomain.pw/ /https://www.whitelisteddomain.tld@localdomain.pw/%2e%2e /https://www.whitelisteddomain.tld@localdomain.pw/%2f%2e%2e /https://www.whitelisteddomain.tld@localdomain.pw/%2f.. /https://www.whitelisteddomain.tld@www.google.com/%2e%2e /https://www.whitelisteddomain.tld@www.google.com/%2f%2e%2e /example.com/%2f%2e%2e /google.com/%2f%2e%2e /localdomain.pw/%2f%2e%2e /redirect?url=//example.com&next=//example.com&redirect=//example.com&redir=//example.com&rurl=//example.com&redirect_uri=//example.com /redirect?url=/\/example.com&next=/\/example.com&redirect=/\/example.com&redir=/\/example.com&rurl=/\/example.com&redirect_uri=/\/example.com /redirect?url=Https://example.com&next=Https://example.com&redirect=Https://example.com&redir=Https://example.com&rurl=Https://example.com&redirect_uri=Https://example.com /x:1/:///%01javascript:alert(document.cookie)/