diff --git a/datasette/app.py b/datasette/app.py
index 09936b3a..be507241 100644
--- a/datasette/app.py
+++ b/datasette/app.py
@@ -2150,6 +2150,11 @@ class DatasetteRouter:
         context = {}
         if path.endswith(b"/"):
             path = path.rstrip(b"/")
+
+            # If you redirect with a // at the beginning, you end up with an open redirect, so
+            # https://my.site//foo/ - will redirect to https://foo
+            path = re.sub(rb"^/+", b"/", path)
+
             if request.scope["query_string"]:
                 path += b"?" + request.scope["query_string"]
             await asgi_send_redirect(send, path.decode("latin1"))
diff --git a/tests/test_custom_pages.py b/tests/test_custom_pages.py
index f2cfe394..ccc139ce 100644
--- a/tests/test_custom_pages.py
+++ b/tests/test_custom_pages.py
@@ -97,3 +97,9 @@ def test_custom_route_pattern_404(custom_pages_client):
     assert response.status == 404
     assert "<h1>Error 404</h1>" in response.text
     assert ">Oh no</" in response.text
+
+
+def test_custom_route_pattern_with_slash_slash_302(custom_pages_client):
+    response = custom_pages_client.get("//nastyOpenRedirect/")
+    assert response.status == 302
+    assert response.headers["location"] == "/nastyOpenRedirect"