diff --git a/src/main/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java b/src/main/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java
index e312fbfee..2b662c414 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjection.java
@@ -89,7 +89,7 @@ private ResponseEntity<?> getURLRedirectionResponseEntity(
             htmlTemplate = "LEVEL_1/Http3xxStatusCodeBasedInjection")
     public ResponseEntity<?> getVulnerablePayloadLevel1(
             @RequestParam(RETURN_TO) String urlToRedirect) {
-        return this.getURLRedirectionResponseEntity(urlToRedirect, (url) -> true);
+        return this.getURLRedirectionResponseEntity(urlToRedirect, WHITELISTED_URLS::contains);
     }
 
     // Payloads:
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjectionTest.java b/src/test/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjectionTest.java
index 734c9c30b..ad01548f6 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjectionTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/openRedirect/Http3xxStatusCodeBasedInjectionTest.java
@@ -23,18 +23,22 @@ void setUp() {
     }
 
     @Test
-    @DisplayName(
-            "Level 1- test that returnTo query parameter's value is directly added to the Location header")
-    void test_That_ReturnToQueryParameterValue_IsAddedToLocationHeader_Level1() {
+    @DisplayName("Level 1- test that external returnTo values are not added to the Location header")
+    void test_That_ExternalReturnToValue_IsNotAddedToLocationHeader_Level1() {
         String redirectUrl = "https://www.malicious.com";
         ResponseEntity<?> responseEntity =
                 http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel1(redirectUrl);
-        assertThat(
-                        responseEntity
-                                .getHeaders()
-                                .get(LOCATION_HEADER_KEY)
-                                .contains("https://www.malicious.com"))
-                .isTrue();
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).isNull();
+        assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.OK);
+    }
+
+    @Test
+    @DisplayName("Level 1- test that allowlisted returnTo values still redirect")
+    void test_That_AllowlistedReturnToValue_IsAddedToLocationHeader_Level1() {
+        String redirectUrl = "/VulnerableApp/";
+        ResponseEntity<?> responseEntity =
+                http3xxStatusCodeBasedInjection.getVulnerablePayloadLevel1(redirectUrl);
+        assertThat(responseEntity.getHeaders().get(LOCATION_HEADER_KEY)).contains(redirectUrl);
         assertThat(responseEntity.getStatusCode()).isEqualTo(HttpStatus.FOUND);
     }