{
  "schema_version": 1,
  "fixture_version": "1.0.0",
  "started_at": "2026-11-10T22:47:50.419703+00:00",
  "method": "Real curl subprocesses against four locally spawned fixture modes",
  "scope": {
    "hosts": [
      "127.0.0.1"
    ],
    "methods": [
      "GET"
    ],
    "paths": [
      "/login"
    ],
    "configured_site_host": "site.example",
    "data": "Synthetic redirect targets. evil.test and site.example are reserved names and are never contacted"
  },
  "versions": {
    "python": "3.15.2",
    "os": "Darwin",
    "architecture": "arm64",
    "curl": "curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0"
  },
  "sha256": {
    "fixture.py": "7dc7d5c44e55398e764d7ab9706f1a87419e0447bfbf20676bc4ba2aeef03911",
    "verify.py": "05b358ee0bfda2acb26ecac151e5a8f083c404b8c36b6f8b7dde0d32a5cf540b"
  },
  "reproduction_command": "python3 verify.py --output recorded-run",
  "browser_model": "browser_host_modeled applies the WHATWG URL rules in browser_host(); no browser ran",
  "agent_execution": {
    "executed": false,
    "note": "HTTP verification was scripted; no model or Excession agent ran"
  },
  "cases": [
    {
      "id": "vulnerable/local-path",
      "started_at": "2026-11-10T22:47:50.467144+00:00",
      "elapsed_ms": 15.276,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53848"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=/account",
        "http://127.0.0.1:53848/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "/account",
      "server_side_urlsplit_netloc": "",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "vulnerable-local-path.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "vulnerable/external-url",
      "started_at": "2026-11-10T22:47:50.482498+00:00",
      "elapsed_ms": 7.53,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "vulnerable",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53848"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://evil.test/phish",
        "http://127.0.0.1:53848/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "https://evil.test/phish",
      "expected_location": "https://evil.test/phish",
      "browser_host_modeled": "evil.test",
      "leaves_site": true,
      "expected_leaves_site": true,
      "matches_demonstration": true,
      "redirect_boundary_holds": false,
      "response_file": "vulnerable-external-url.http",
      "response_sha256": "eb91601837845bf0a694ab67e524f189a584df52cecb7b46a4698b79ecd94bf1"
    },
    {
      "id": "naive-slash/local-path",
      "started_at": "2026-11-10T22:47:50.526946+00:00",
      "elapsed_ms": 9.977,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-slash",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53851"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=/account",
        "http://127.0.0.1:53851/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "/account",
      "server_side_urlsplit_netloc": "",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "naive-slash-local-path.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "naive-slash/external-url",
      "started_at": "2026-11-10T22:47:50.536982+00:00",
      "elapsed_ms": 7.913,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-slash",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53851"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://evil.test/phish",
        "http://127.0.0.1:53851/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "naive-slash-external-url.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "naive-slash/double-slash",
      "started_at": "2026-11-10T22:47:50.544943+00:00",
      "elapsed_ms": 8.198,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-slash",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53851"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=//evil.test/phish",
        "http://127.0.0.1:53851/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "//evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "//evil.test/phish",
      "expected_location": "//evil.test/phish",
      "browser_host_modeled": "evil.test",
      "leaves_site": true,
      "expected_leaves_site": true,
      "matches_demonstration": true,
      "redirect_boundary_holds": false,
      "response_file": "naive-slash-double-slash.http",
      "response_sha256": "a36b679cdb144a5d02c44a2c5ffd9eb079c56fba623c741968d270a34f9413ba"
    },
    {
      "id": "naive-slash/backslash",
      "started_at": "2026-11-10T22:47:50.553212+00:00",
      "elapsed_ms": 11.4,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-slash",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53851"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=/\\evil.test/phish",
        "http://127.0.0.1:53851/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "/\\evil.test/phish",
      "server_side_urlsplit_netloc": "",
      "observed_status": 302,
      "observed_location": "/\\evil.test/phish",
      "expected_location": "/\\evil.test/phish",
      "browser_host_modeled": "evil.test",
      "leaves_site": true,
      "expected_leaves_site": true,
      "matches_demonstration": true,
      "redirect_boundary_holds": false,
      "response_file": "naive-slash-backslash.http",
      "response_sha256": "96b972d4f02d43de63ecb292e73a84bc7864d3d7c897ae4bd6be790d8fa2e8a1"
    },
    {
      "id": "naive-slash/tab-slash",
      "started_at": "2026-11-10T22:47:50.564760+00:00",
      "elapsed_ms": 8.924,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-slash",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53851"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=/\t/evil.test/phish",
        "http://127.0.0.1:53851/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "/\t/evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "/\t/evil.test/phish",
      "expected_location": "/\t/evil.test/phish",
      "browser_host_modeled": "evil.test",
      "leaves_site": true,
      "expected_leaves_site": true,
      "matches_demonstration": true,
      "redirect_boundary_holds": false,
      "response_file": "naive-slash-tab-slash.http",
      "response_sha256": "052c9b5a00cc0e80be2d958e5531c891f93caad91e010bf0df92e03cbfa8e669"
    },
    {
      "id": "naive-host/same-site-url",
      "started_at": "2026-11-10T22:47:50.655910+00:00",
      "elapsed_ms": 17.802,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-host",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53858"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://site.example/account",
        "http://127.0.0.1:53858/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://site.example/account",
      "server_side_urlsplit_netloc": "site.example",
      "observed_status": 302,
      "observed_location": "https://site.example/account",
      "expected_location": "https://site.example/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "naive-host-same-site-url.http",
      "response_sha256": "06ac954a17d2410962a42597e63f3226a715d928a1c6cce553fc52841fcc01b5"
    },
    {
      "id": "naive-host/external-url",
      "started_at": "2026-11-10T22:47:50.673797+00:00",
      "elapsed_ms": 10.293,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-host",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53858"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://evil.test/phish",
        "http://127.0.0.1:53858/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "naive-host-external-url.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "naive-host/lookalike-host",
      "started_at": "2026-11-10T22:47:50.684145+00:00",
      "elapsed_ms": 12.597,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-host",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53858"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://site.example.evil.test/phish",
        "http://127.0.0.1:53858/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://site.example.evil.test/phish",
      "server_side_urlsplit_netloc": "site.example.evil.test",
      "observed_status": 302,
      "observed_location": "https://site.example.evil.test/phish",
      "expected_location": "https://site.example.evil.test/phish",
      "browser_host_modeled": "site.example.evil.test",
      "leaves_site": true,
      "expected_leaves_site": true,
      "matches_demonstration": true,
      "redirect_boundary_holds": false,
      "response_file": "naive-host-lookalike-host.http",
      "response_sha256": "c3bca3a9c7544e5480211ba0d4822c2d6fc82143029fb3f5d29dedf5b5570b9e"
    },
    {
      "id": "naive-host/host-in-query",
      "started_at": "2026-11-10T22:47:50.697030+00:00",
      "elapsed_ms": 15.538,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-host",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53858"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://evil.test/?site.example",
        "http://127.0.0.1:53858/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://evil.test/?site.example",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "https://evil.test/?site.example",
      "expected_location": "https://evil.test/?site.example",
      "browser_host_modeled": "evil.test",
      "leaves_site": true,
      "expected_leaves_site": true,
      "matches_demonstration": true,
      "redirect_boundary_holds": false,
      "response_file": "naive-host-host-in-query.http",
      "response_sha256": "d54427c40089f658533d840935a901946c022bed3c99c52dc96ed6959ba7e3e3"
    },
    {
      "id": "naive-host/userinfo",
      "started_at": "2026-11-10T22:47:50.712680+00:00",
      "elapsed_ms": 13.745,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "naive-host",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53858"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://site.example@evil.test/phish",
        "http://127.0.0.1:53858/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://site.example@evil.test/phish",
      "server_side_urlsplit_netloc": "site.example@evil.test",
      "observed_status": 302,
      "observed_location": "https://site.example@evil.test/phish",
      "expected_location": "https://site.example@evil.test/phish",
      "browser_host_modeled": "evil.test",
      "leaves_site": true,
      "expected_leaves_site": true,
      "matches_demonstration": true,
      "redirect_boundary_holds": false,
      "response_file": "naive-host-userinfo.http",
      "response_sha256": "a98267ae83b5ab36b0e340abbeed6d0b71416aff81c56a0a8c0d9cf3d4fe699c"
    },
    {
      "id": "fixed/local-path",
      "started_at": "2026-11-10T22:47:50.778818+00:00",
      "elapsed_ms": 14.116,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=/account",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "/account",
      "server_side_urlsplit_netloc": "",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-local-path.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/local-path-with-query",
      "started_at": "2026-11-10T22:47:50.793045+00:00",
      "elapsed_ms": 11.07,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=/account/billing?tab=invoices",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "/account/billing?tab=invoices",
      "server_side_urlsplit_netloc": "",
      "observed_status": 302,
      "observed_location": "/account/billing?tab=invoices",
      "expected_location": "/account/billing?tab=invoices",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-local-path-with-query.http",
      "response_sha256": "34bca63e241121c3fc31dbd9e1befb2ab4fc5937d8e465208bf6e41064daea14"
    },
    {
      "id": "fixed/external-url",
      "started_at": "2026-11-10T22:47:50.804180+00:00",
      "elapsed_ms": 11.564,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://evil.test/phish",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-external-url.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/same-site-absolute-url",
      "started_at": "2026-11-10T22:47:50.815816+00:00",
      "elapsed_ms": 9.37,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://site.example/account",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://site.example/account",
      "server_side_urlsplit_netloc": "site.example",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-same-site-absolute-url.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/double-slash",
      "started_at": "2026-11-10T22:47:50.825241+00:00",
      "elapsed_ms": 8.916,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=//evil.test/phish",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "//evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-double-slash.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/backslash",
      "started_at": "2026-11-10T22:47:50.834247+00:00",
      "elapsed_ms": 11.803,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=/\\evil.test/phish",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "/\\evil.test/phish",
      "server_side_urlsplit_netloc": "",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-backslash.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/tab-slash",
      "started_at": "2026-11-10T22:47:50.846108+00:00",
      "elapsed_ms": 7.705,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=/\t/evil.test/phish",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "/\t/evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-tab-slash.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/lookalike-host",
      "started_at": "2026-11-10T22:47:50.853865+00:00",
      "elapsed_ms": 10.229,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://site.example.evil.test/phish",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://site.example.evil.test/phish",
      "server_side_urlsplit_netloc": "site.example.evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-lookalike-host.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/host-in-query",
      "started_at": "2026-11-10T22:47:50.864164+00:00",
      "elapsed_ms": 10.529,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://evil.test/?site.example",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://evil.test/?site.example",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-host-in-query.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/userinfo",
      "started_at": "2026-11-10T22:47:50.874747+00:00",
      "elapsed_ms": 8.676,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "next=https://site.example@evil.test/phish",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "next",
      "input": "https://site.example@evil.test/phish",
      "server_side_urlsplit_netloc": "site.example@evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-userinfo.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    },
    {
      "id": "fixed/allowlist-key",
      "started_at": "2026-11-10T22:47:50.883474+00:00",
      "elapsed_ms": 8.391,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "dest=billing",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "dest",
      "input": "billing",
      "server_side_urlsplit_netloc": "",
      "observed_status": 302,
      "observed_location": "/account/billing",
      "expected_location": "/account/billing",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-allowlist-key.http",
      "response_sha256": "1ca92218870c47d6ab50b0c273e7eecbad38b30a27aaebb7c4cee8a65bbd4bda"
    },
    {
      "id": "fixed/allowlist-unknown-url",
      "started_at": "2026-11-10T22:47:50.891934+00:00",
      "elapsed_ms": 9.321,
      "server": {
        "fixture_version": "1.0.0",
        "mode": "fixed",
        "site_host": "site.example",
        "base_url": "http://127.0.0.1:53864"
      },
      "command": [
        "curl",
        "--noproxy",
        "*",
        "--silent",
        "--show-error",
        "--include",
        "--http1.1",
        "--connect-timeout",
        "1",
        "--max-time",
        "3",
        "--get",
        "--data-urlencode",
        "dest=https://evil.test/phish",
        "http://127.0.0.1:53864/login"
      ],
      "curl_exit_code": 0,
      "stderr": "",
      "parameter": "dest",
      "input": "https://evil.test/phish",
      "server_side_urlsplit_netloc": "evil.test",
      "observed_status": 302,
      "observed_location": "/account",
      "expected_location": "/account",
      "browser_host_modeled": "site.example",
      "leaves_site": false,
      "expected_leaves_site": false,
      "matches_demonstration": true,
      "redirect_boundary_holds": true,
      "response_file": "fixed-allowlist-unknown-url.http",
      "response_sha256": "22388e7abcba44044e1cdfd18e0cf2e080a4905b2c9b323af9550ef90b90c821"
    }
  ],
  "failures": [],
  "finished_at": "2026-11-10T22:47:50.902429+00:00",
  "all_demonstration_checks_passed": true
}