code: private static Optional<String> sanitizeRedirectUrl(@Nullable String url) {
      if (Strings.isNullOrEmpty(url)) {
        return empty();
      }
      if (url.startsWith("//") || url.startsWith("/\\")) {
        return empty();
      }
      if (!url.startsWith("/")) {
        return empty();
      }
      return Optional.of(url);
    }
docs: This sanitization has been inspired by 'IsUrlLocalToHost()' method in
  https://docs.microsoft.com/en-us/aspnet/mvc/overview/security/preventing-open-redirection-attacks