you should start by saying that

- your app is hosted at url https://myapp.example.com/
- but some of your templates are hosted on another domain you control: http://assets.eample.com/
- and you have an open redirect at http://assets.example.com/

here is what a secure configuration for this scenario would look like: