RedirectResponse refuses external URLs unless you pass allow_external=True. That check now blocks any scheme-prefixed URL: browsers normalize http:/evil.com to http://evil.com, so matching on :// alone let single-slash URLs through.