### Overview `AddPageController::__invoke()` returns a plain `\Symfony\Component\HttpFoundation\RedirectResponse`. Redirects to internal URLs should use a secured `\Drupal\Core\Routing\LocalRedirectResponse` so that only on-site targets are ever followed. This is the remaining occurrence of a plain `RedirectResponse` after the `CanvasRouteOptionsEventSubscriber` one was switched to a secured redirect in !1191 (follow-up to #3591585). Spotted in https://git.drupalcode.org/project/canvas/-/merge_requests/1191#note_1072024. ### Proposed resolution Return a `LocalRedirectResponse` from `AddPageController::__invoke()` instead of `RedirectResponse`. The redirect target is the internal `entity.canvas_page.edit_form` route, so it is always a local URL. ### Remaining tasks - Swap the response class in `AddPageController::__invoke()`. ### User interface changes None. ### API changes None.