Validating the URL before page.goto() is not enough: redirects slip past Playwright's page.route()

A tested comparison of three SSRF guards for a Playwright renderer: check once, check every request, and follow redirects yourself. With the output of each.