diff --git a/datasette/app.py b/datasette/app.py
index bf6cc03f..cefb6e4e 100644
--- a/datasette/app.py
+++ b/datasette/app.py
@@ -1806,8 +1806,14 @@ class DatasetteRouter:
             "raw_path", request.scope["path"].encode("utf8")
         ).partition(b"?")[0]
         context = {}
+
         if path.endswith(b"/"):
             path = path.rstrip(b"/")
+
+            # If you redirect with a // at the beginning, you end up with an open redirect, so
+            # https://my.site//foo/ - will redirect to https://foo
+            path = re.sub(rb'^/+', b'/', path)
+
             if request.scope["query_string"]:
                 path += b"?" + request.scope["query_string"]
             await asgi_send_redirect(send, path.decode("latin1"))