How is this an SSRF? The redirection is in client side. Can you access company’s internal assets? This is Open redirect right