Going the long way round
/api/redirect/ is on this origin, so it is permitted. It sends a 302 to evil-cyber-hacker.com, which is not.
🛡️ The redirect is refused. The first hop is on this origin, so the
request is sent. The destination it forwards to is not on the list, and because
redirects defaults to block the browser will not follow it.
Why the default is block
A list that permits an origin but not where that origin sends you is not really a list. Any permitted destination under an attacker's influence — a compromised vendor, an open redirect on a domain you trust — becomes a way to reach anything.
You can opt into redirects=allow if a destination you rely on genuinely redirects,
but that is a decision to make deliberately, and the reports tell you when you need to make it.
Connection Allowlist header sent with this page
Connection-Allowlist: (response-origin); report-to=default