Redirect chain downgrades to HTTP
At least one hop moves from an HTTPS URL to an HTTP Location.
Why it matters
The browser is sent back to plaintext after it already had HTTPS, which is where a network attacker can take the session.
What to do
Make every Location stay on HTTPS.
Reference
Redirect chains should preserve HTTPS and avoid open-redirect patterns.