diff --git a/corporate/tests/test_stripe.py b/corporate/tests/test_stripe.py
index 22f4514aa7..8d38f4667e 100644
--- a/corporate/tests/test_stripe.py
+++ b/corporate/tests/test_stripe.py
@@ -835,7 +835,7 @@ class StripeTest(StripeTestCase):
         # Check that we can no longer access /upgrade
         response = self.client_get("/upgrade/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/billing/", response.url)
+        self.assertEqual("/billing/", response["Location"])
 
         # Check /billing has the correct information
         with patch("corporate.views.billing_page.timezone_now", return_value=self.now):
@@ -976,7 +976,7 @@ class StripeTest(StripeTestCase):
         # Check that we can no longer access /upgrade
         response = self.client_get("/upgrade/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/billing/", response.url)
+        self.assertEqual("/billing/", response["Location"])
 
         # Check /billing has the correct information
         with patch("corporate.views.billing_page.timezone_now", return_value=self.now):
@@ -1534,7 +1534,7 @@ class StripeTest(StripeTestCase):
         # Check that we still get redirected to /upgrade
         response = self.client_get("/billing/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/upgrade/", response.url)
+        self.assertEqual("/upgrade/", response["Location"])
 
         [last_event] = stripe.Event.list(limit=1)
         retry_payment_intent_json_response = self.client_post(
@@ -1629,7 +1629,7 @@ class StripeTest(StripeTestCase):
         # Check that we can no longer access /upgrade
         response = self.client_get("/upgrade/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/billing/", response.url)
+        self.assertEqual("/billing/", response["Location"])
 
     @mock_stripe()
     def test_upgrade_first_card_fails_and_restart_from_begining(self, *mocks: Mock) -> None:
@@ -1702,7 +1702,7 @@ class StripeTest(StripeTestCase):
         # Check that we still get redirected to /upgrade
         response = self.client_get("/billing/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/upgrade/", response.url)
+        self.assertEqual("/upgrade/", response["Location"])
 
         # Try again, with a valid card, after they added a few users
         with patch("corporate.lib.stripe.get_latest_seat_count", return_value=23):
@@ -1761,7 +1761,7 @@ class StripeTest(StripeTestCase):
         # Check that we can no longer access /upgrade
         response = self.client_get("/upgrade/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/billing/", response.url)
+        self.assertEqual("/billing/", response["Location"])
 
     def test_upgrade_with_tampered_seat_count(self) -> None:
         hamlet = self.example_user("hamlet")
@@ -2262,7 +2262,7 @@ class StripeTest(StripeTestCase):
 
         response = self.client_get("/upgrade/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, "/billing/")
+        self.assertEqual(response["Location"], "/billing/")
 
         response = self.client_get("/billing/")
         self.assert_in_success_response(
@@ -2290,7 +2290,7 @@ class StripeTest(StripeTestCase):
         self.login_user(user)
         response = self.client_get("/billing/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/upgrade/", response.url)
+        self.assertEqual("/upgrade/", response["Location"])
 
         user.realm.plan_type = Realm.PLAN_TYPE_STANDARD_FREE
         user.realm.save()
@@ -2302,7 +2302,7 @@ class StripeTest(StripeTestCase):
         Customer.objects.create(realm=user.realm, stripe_customer_id="cus_123")
         response = self.client_get("/billing/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/upgrade/", response.url)
+        self.assertEqual("/upgrade/", response["Location"])
 
     def test_redirect_for_upgrade_page(self) -> None:
         user = self.example_user("iago")
@@ -2315,7 +2315,7 @@ class StripeTest(StripeTestCase):
         user.realm.save()
         response = self.client_get("/upgrade/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, "/billing/")
+        self.assertEqual(response["Location"], "/billing/")
 
         user.realm.plan_type = Realm.PLAN_TYPE_LIMITED
         user.realm.save()
@@ -2331,16 +2331,16 @@ class StripeTest(StripeTestCase):
         )
         response = self.client_get("/upgrade/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, "/billing/")
+        self.assertEqual(response["Location"], "/billing/")
 
         with self.settings(FREE_TRIAL_DAYS=30):
             response = self.client_get("/upgrade/")
             self.assertEqual(response.status_code, 302)
-            self.assertEqual(response.url, "/billing/")
+            self.assertEqual(response["Location"], "/billing/")
 
             response = self.client_get("/upgrade/", {"onboarding": "true"})
             self.assertEqual(response.status_code, 302)
-            self.assertEqual(response.url, "/billing/?onboarding=true")
+            self.assertEqual(response["Location"], "/billing/?onboarding=true")
 
     def test_get_latest_seat_count(self) -> None:
         realm = get_realm("zulip")
@@ -4128,7 +4128,7 @@ class RequiresBillingAccessTest(StripeTestCase):
         self.login_user(self.example_user("hamlet"))
         response = self.client_get("/billing/")
         self.assertEqual(response.status_code, 302)
-        self.assertEqual("/upgrade/", response.url)
+        self.assertEqual("/upgrade/", response["Location"])
         # Check that non-admins can sign up and pay
         self.upgrade()
         # Check that the non-admin hamlet can still access /billing
diff --git a/zerver/tests/test_auth_backends.py b/zerver/tests/test_auth_backends.py
index 2349b3f98b..c4bce484ed 100644
--- a/zerver/tests/test_auth_backends.py
+++ b/zerver/tests/test_auth_backends.py
@@ -176,7 +176,7 @@ class AuthBackendTest(ZulipTestCase):
             # Returns a redirect to login page with an error.
             self.assertEqual(result.status_code, 302)
             self.assertEqual(
-                result.url,
+                result["Location"],
                 f"{user_profile.realm.uri}/login/?"
                 + urlencode({"is_deactivated": user_profile.delivery_email}),
             )
@@ -197,7 +197,7 @@ class AuthBackendTest(ZulipTestCase):
         result = backend.authenticate(**good_kwargs)
         if isinstance(backend, SocialAuthMixin):
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, user_profile.realm.uri + "/login/")
+            self.assertEqual(result["Location"], user_profile.realm.uri + "/login/")
         else:
             self.assertIsNone(result)
 
@@ -217,7 +217,7 @@ class AuthBackendTest(ZulipTestCase):
             result = backend.authenticate(**good_kwargs)
             if isinstance(backend, SocialAuthMixin):
                 self.assertEqual(result.status_code, 302)
-                self.assertEqual(result.url, user_profile.realm.uri + "/login/")
+                self.assertEqual(result["Location"], user_profile.realm.uri + "/login/")
             else:
                 self.assertIsNone(result)
         clear_supported_auth_backends_cache()
@@ -241,7 +241,7 @@ class AuthBackendTest(ZulipTestCase):
 
         if isinstance(backend, SocialAuthMixin):
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, user_profile.realm.uri + "/login/")
+            self.assertEqual(result["Location"], user_profile.realm.uri + "/login/")
         else:
             self.assertIsNone(result)
         user_profile.realm.authentication_methods.set_bit(index, True)
@@ -400,7 +400,7 @@ class AuthBackendTest(ZulipTestCase):
 
         result = self.client_get("/login/")
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "http://zulip.testserver")
+        self.assertEqual(result["Location"], "http://zulip.testserver")
 
     @override_settings(AUTHENTICATION_BACKENDS=("zproject.backends.ZulipDummyBackend",))
     def test_no_backend_enabled(self) -> None:
@@ -933,7 +933,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         headers: Any,
         **extra_data: Any,
     ) -> HttpResponse:
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         csrf_state = urllib.parse.parse_qs(parsed_url.query)["state"]
         result = self.client_get(self.AUTH_FINISH_URL, dict(state=csrf_state), **headers)
         return result
@@ -1006,12 +1006,14 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
                 f"http://{settings.SOCIAL_AUTH_SUBDOMAIN}.testserver/login/{self.backend.name}/"
             )
 
-        if result.status_code != 302 or not result.url.startswith(expected_result_url_prefix):
+        if result.status_code != 302 or not result["Location"].startswith(
+            expected_result_url_prefix
+        ):
             return result
 
-        result = self.client_get(result.url, **headers)
+        result = self.client_get(result["Location"], **headers)
         self.assertEqual(result.status_code, 302)
-        assert self.AUTHORIZATION_URL in result.url
+        assert self.AUTHORIZATION_URL in result["Location"]
 
         self.client.cookies = result.cookies
 
@@ -1090,7 +1092,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(data["redirect_to"], "/user_uploads/image")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -1114,7 +1116,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(data["redirect_to"], "/user_uploads/image")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -1131,7 +1133,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
             )
             self.assertEqual(result.status_code, 302)
             self.assertEqual(
-                result.url,
+                result["Location"],
                 f"{user_profile.realm.uri}/login/?"
                 + urlencode({"is_deactivated": user_profile.delivery_email}),
             )
@@ -1144,7 +1146,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
             ],
         )
 
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         self.assert_in_success_response(
             [f"Your account {user_profile.delivery_email} has been deactivated."], result
         )
@@ -1158,7 +1160,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
                 account_data_dict, subdomain="invalid", next="/user_uploads/image"
             )
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "/accounts/find/")
+        self.assertEqual(result["Location"], "/accounts/find/")
 
     def test_social_auth_invalid_email(self) -> None:
         account_data_dict = self.get_account_data_dict(email="invalid", name=self.name)
@@ -1181,7 +1183,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
             ],
         )
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, realm.uri + "/register/")
+        self.assertEqual(result["Location"], realm.uri + "/register/")
 
     def test_user_cannot_log_into_nonexisting_realm(self) -> None:
         account_data_dict = self.get_account_data_dict(email=self.email, name=self.name)
@@ -1194,9 +1196,11 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         result = self.social_auth_test(
             account_data_dict, expect_choose_email_screen=True, subdomain="zephyr"
         )
-        self.assertTrue(result.url.startswith("http://zephyr.testserver/accounts/login/subdomain/"))
+        self.assertTrue(
+            result["Location"].startswith("http://zephyr.testserver/accounts/login/subdomain/")
+        )
         result = self.client_get(
-            result.url.replace("http://zephyr.testserver", ""), subdomain="zephyr"
+            result["Location"].replace("http://zephyr.testserver", ""), subdomain="zephyr"
         )
         self.assert_in_success_response(
             [
@@ -1292,7 +1296,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
             result = self.client_get(url, **headers)
             self.assertEqual(result.status_code, 302)
 
-            result = self.client_get(result.url, **headers)
+            result = self.client_get(result["Location"], **headers)
             self.assertEqual(result.status_code, 302)
 
         # Start social auth with mobile_flow_otp param. It should get saved into the session
@@ -1334,7 +1338,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         self.assertEqual(data["full_name"], self.example_user("hamlet").full_name)
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
         hamlet = self.example_user("hamlet")
@@ -1360,11 +1364,11 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         self.assertEqual(data["full_name"], name)
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
 
         if expect_confirm_registration_page:
             self.assertEqual(result.status_code, 200)
@@ -1377,8 +1381,8 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
             self.assert_in_success_response(["do_confirm/" + confirmation_key], result)
             do_confirm_url = "/accounts/do_confirm/" + confirmation_key
         else:
-            self.assertIn("do_confirm/" + confirmation_key, result.url)
-            do_confirm_url = result.url
+            self.assertIn("do_confirm/" + confirmation_key, result["Location"])
+            do_confirm_url = result["Location"]
         result = self.client_get(do_confirm_url, name=name)
         self.assert_in_response('action="/accounts/register/"', result)
         confirmation_data = {"from_confirmation": "1", "key": confirmation_key}
@@ -1531,7 +1535,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
             multiuse_object_key=multiuse_object_key,
         )
         self.assertEqual(result.status_code, 302)
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
 
         self.assertEqual(result.status_code, 404)
         self.assert_in_response("Whoops. The confirmation link is malformed.", result)
@@ -1568,7 +1572,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         result = self.social_auth_test(
             account_data_dict, expect_choose_email_screen=True, subdomain=subdomain, is_signup=True
         )
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         # Verify that we're unable to sign up, since this is a closed realm
         self.assertEqual(result.status_code, 200)
         self.assert_in_success_response(["Sign up"], result)
@@ -1621,7 +1625,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
             multiuse_object_key=multiuse_object_key,
         )
 
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         self.assert_in_response(
             "Whoops. We couldn't find your confirmation link in the system.", result
         )
@@ -1640,11 +1644,11 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         self.assertEqual(data["full_name"], name)
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         self.assertEqual(result.status_code, 200)
         self.assert_in_response("No account found for newuser@zulip.com.", result)
 
@@ -1664,11 +1668,11 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         self.assertEqual(data["full_name"], name)
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         self.assertEqual(result.status_code, 200)
         self.assert_in_response('action="/register/"', result)
         self.assert_in_response(
@@ -1803,7 +1807,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         ), self.assertLogs(self.logger_string, level="INFO") as m:
             result = self.client_get(reverse("social:complete", args=[self.backend.name]))
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -1817,7 +1821,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         ), self.assertLogs(self.logger_string, level="INFO") as m:
             result = self.client_get(reverse("social:complete", args=[self.backend.name]))
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -1832,7 +1836,7 @@ class SocialAuthBase(DesktopFlowTestingLib, ZulipTestCase, ABC):
         ), self.assertLogs(self.logger_string, level="WARNING"):
             result = self.client_get(reverse("social:complete", args=[self.backend.name]))
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
 
     @override_settings(TERMS_OF_SERVICE_VERSION=None)
     def test_social_auth_invited_as_admin_but_expired(self) -> None:
@@ -1907,17 +1911,19 @@ class SAMLAuthBackendTest(SocialAuthBase):
                 f"http://{settings.SOCIAL_AUTH_SUBDOMAIN}.testserver/login/{self.backend.name}/"
             )
 
-        if result.status_code != 302 or not result.url.startswith(expected_result_url_prefix):
+        if result.status_code != 302 or not result["Location"].startswith(
+            expected_result_url_prefix
+        ):
             return result
 
-        result = self.client_get(result.url, **headers)
+        result = self.client_get(result["Location"], **headers)
 
         self.assertEqual(result.status_code, 302)
-        assert self.AUTHORIZATION_URL in result.url
-        assert "samlrequest" in result.url.lower()
+        assert self.AUTHORIZATION_URL in result["Location"]
+        assert "samlrequest" in result["Location"].lower()
 
         self.client.cookies = result.cookies
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         relay_state = urllib.parse.parse_qs(parsed_url.query)["RelayState"][0]
         # Make sure params are getting encoded into RelayState:
         data = SAMLAuthBackend.get_data_from_redis(orjson.loads(relay_state)["state_token"])
@@ -2263,7 +2269,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
                 post_params = {"SAMLResponse": saml_response, "RelayState": relay_state}
                 result = self.client_post("/complete/saml/", post_params)
                 self.assertEqual(result.status_code, 302)
-                self.assertIn("login", result.url)
+                self.assertIn("login", result["Location"])
             self.assertEqual(
                 m.output,
                 [
@@ -2288,7 +2294,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
                 post_params = {"SAMLResponse": saml_response, "RelayState": relay_state}
                 result = self.client_post("/complete/saml/", post_params)
                 self.assertEqual(result.status_code, 302)
-                self.assertIn("login", result.url)
+                self.assertIn("login", result["Location"])
             self.assertEqual(
                 m.output, [self.logger_output("Wrong state parameter given.", "warning")]
             )
@@ -2300,7 +2306,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
         with self.assertLogs(self.logger_string, level="INFO") as m:
             result = self.client_get("/complete/saml/")
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -2321,7 +2327,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             post_params = {"RelayState": relay_state}
             result = self.client_post("/complete/saml/", post_params)
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -2341,7 +2347,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             post_params = {"RelayState": relay_state, "SAMLResponse": ""}
             result = self.client_post("/complete/saml/", post_params)
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
         self.assertTrue(m.output != "")
 
         with self.assertLogs(self.logger_string, level="INFO") as m:
@@ -2353,7 +2359,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             post_params = {"RelayState": relay_state, "SAMLResponse": "b"}
             result = self.client_post("/complete/saml/", post_params)
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
         self.assertTrue(m.output != "")
 
         with self.assertLogs(self.logger_string, level="INFO") as m:
@@ -2368,7 +2374,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             }
             result = self.client_post("/complete/saml/", post_params)
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
         self.assertTrue(m.output != "")
 
     def test_social_auth_complete_no_subdomain(self) -> None:
@@ -2382,7 +2388,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             with mock.patch.object(SAMLAuthBackend, "choose_subdomain", return_value=None):
                 result = self.client_post("/complete/saml/", post_params)
             self.assertEqual(result.status_code, 302)
-            self.assertEqual("/login/", result.url)
+            self.assertEqual("/login/", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -2414,7 +2420,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
                 post_params = {"RelayState": relay_state, "SAMLResponse": saml_response}
                 result = self.client_post("/complete/saml/", post_params)
                 self.assertEqual(result.status_code, 302)
-                self.assertEqual("/login/", result.url)
+                self.assertEqual("/login/", result["Location"])
             self.assertEqual(
                 m.output,
                 [
@@ -2445,7 +2451,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             }
             result = self.client_post("/complete/saml/", post_params)
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
 
         self.assertTrue(m.output != "")
 
@@ -2453,7 +2459,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
         with self.assertLogs(self.logger_string, level="INFO") as m:
             result = self.client_get("/login/saml/")
             self.assertEqual(result.status_code, 302)
-            self.assertEqual("/login/", result.url)
+            self.assertEqual("/login/", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -2466,7 +2472,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
         with self.assertLogs(self.logger_string, level="INFO") as m:
             result = self.client_get("/login/saml/", {"idp": "bad_idp"})
             self.assertEqual(result.status_code, 302)
-            self.assertEqual("/login/", result.url)
+            self.assertEqual("/login/", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -2496,7 +2502,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             warn_log.output, [self.logger_output("SAML got invalid email argument.", "warning")]
         )
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, realm.uri + "/register/")
+        self.assertEqual(result["Location"], realm.uri + "/register/")
 
     def test_social_auth_saml_multiple_idps_configured(self) -> None:
         # Set up a new SOCIAL_AUTH_SAML_ENABLED_IDPS dict with two idps.
@@ -2556,7 +2562,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             with self.assertLogs(self.logger_string, level="INFO") as m:
                 result = self.social_auth_test(account_data_dict, subdomain="zephyr")
         self.assertEqual(result.status_code, 302)
-        self.assertEqual("/login/", result.url)
+        self.assertEqual("/login/", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -2639,7 +2645,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["full_name"], self.name)
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -2657,7 +2663,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
             result = self.client_post("/complete/saml/", post_params)
 
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "/accounts/find/")
+        self.assertEqual(result["Location"], "/accounts/find/")
 
     def test_idp_initiated_signin_subdomain_implicit(self) -> None:
         post_params = {
@@ -2674,7 +2680,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["full_name"], self.name)
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -2695,7 +2701,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["full_name"], self.name)
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -2715,7 +2721,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
                 result = self.client_post("http://invalid.testserver/complete/saml/", post_params)
 
             self.assertEqual(result.status_code, 302)
-            self.assertEqual("/login/", result.url)
+            self.assertEqual("/login/", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -2799,7 +2805,7 @@ class SAMLAuthBackendTest(SocialAuthBase):
                     extra_attributes=dict(member=["zephyr", "othersubdomain"]),
                 )
         self.assertEqual(result.status_code, 302)
-        self.assertEqual("/login/", result.url)
+        self.assertEqual("/login/", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -2959,7 +2965,7 @@ class AppleIdAuthBackendTest(AppleAuthMixin, SocialAuthBase):
         headers: Any,
         **extra_data: Any,
     ) -> HttpResponse:
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         state = urllib.parse.parse_qs(parsed_url.query)["state"]
         user_param = json.dumps(account_data_dict)
         self.client.session.flush()
@@ -3036,7 +3042,7 @@ class AppleIdAuthBackendTest(AppleAuthMixin, SocialAuthBase):
                     is_signup=True,
                 )
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "/login/")
+        self.assertEqual(result["Location"], "/login/")
         self.assertEqual(
             m.output,
             [
@@ -3052,13 +3058,13 @@ class AppleIdAuthBackendTest(AppleAuthMixin, SocialAuthBase):
             # (1) check if auth fails if no state value is sent.
             result = self.client_post("/complete/apple/")
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
 
             # (2) Check if auth fails when a state sent has no valid data stored in Redis.
             fake_state = "fa42e4ccdb630f0070c1daab70ad198d8786d4b639cd7a1b4db4d5a13c623060"
             result = self.client_post("/complete/apple/", {"state": fake_state})
             self.assertEqual(result.status_code, 302)
-            self.assertIn("login", result.url)
+            self.assertIn("login", result["Location"])
         self.assertEqual(
             m.output,
             [
@@ -3510,7 +3516,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         expect_noreply_email_allowed: bool = False,
         **extra_data: Any,
     ) -> HttpResponse:
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         csrf_state = urllib.parse.parse_qs(parsed_url.query)["state"]
         result = self.client_get(self.AUTH_FINISH_URL, dict(state=csrf_state), **headers)
 
@@ -3601,7 +3607,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
                 account_data_dict, subdomain=subdomain, email_data=email_data
             )
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, realm.uri + "/login/")
+            self.assertEqual(result["Location"], realm.uri + "/login/")
         self.assertEqual(
             m.output,
             [
@@ -3623,7 +3629,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         ), self.assertLogs(self.logger_string, level="INFO") as mock_info:
             result = self.social_auth_test(account_data_dict, subdomain=subdomain)
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, realm.uri + "/login/")
+            self.assertEqual(result["Location"], realm.uri + "/login/")
         self.assertEqual(
             mock_info.output,
             [
@@ -3659,7 +3665,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         ), self.assertLogs(self.logger_string, level="INFO") as mock_info:
             result = self.social_auth_test(account_data_dict, subdomain=subdomain)
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, realm.uri + "/login/")
+            self.assertEqual(result["Location"], realm.uri + "/login/")
         self.assertEqual(
             mock_info.output,
             [
@@ -3712,7 +3718,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(data["redirect_to"], "/user_uploads/image")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -3737,7 +3743,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(data["redirect_to"], "/user_uploads/image")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -3766,7 +3772,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(data["redirect_to"], "/user_uploads/image")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -3795,7 +3801,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(data["redirect_to"], "/user_uploads/image")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -3856,7 +3862,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(data["redirect_to"], "/user_uploads/image")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -3909,7 +3915,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
                 email_data=email_data,
             )
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, realm.uri + "/login/")
+            self.assertEqual(result["Location"], realm.uri + "/login/")
         self.assertEqual(
             m.output,
             [
@@ -3939,7 +3945,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
         self.assertEqual(data["full_name"], account_data_dict["name"])
         self.assertEqual(data["subdomain"], "zulip")
         self.assertEqual(result.status_code, 302)
-        parsed_url = urllib.parse.urlparse(result.url)
+        parsed_url = urllib.parse.urlparse(result["Location"])
         uri = f"{parsed_url.scheme}://{parsed_url.netloc}{parsed_url.path}"
         self.assertTrue(uri.startswith("http://zulip.testserver/accounts/login/subdomain/"))
 
@@ -3962,7 +3968,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
                 email_data=email_data,
             )
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, realm.uri + "/login/")
+            self.assertEqual(result["Location"], realm.uri + "/login/")
         self.assertEqual(
             m.output,
             [
@@ -3994,7 +4000,7 @@ class GitHubAuthBackendTest(SocialAuthBase):
                 email_data=email_data,
             )
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, realm.uri + "/login/")
+            self.assertEqual(result["Location"], realm.uri + "/login/")
         self.assertEqual(
             m.output,
             [
@@ -4048,7 +4054,7 @@ class GoogleAuthBackendTest(SocialAuthBase):
         with self.assertLogs(self.logger_string, level="WARNING") as m:
             result = self.social_auth_test(account_data_dict, subdomain=subdomain)
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, realm.uri + "/login/")
+            self.assertEqual(result["Location"], realm.uri + "/login/")
         self.assertEqual(
             m.output,
             [
@@ -4167,14 +4173,14 @@ class GoogleAuthBackendTest(SocialAuthBase):
 
         res = test_redirect_to_next_url()
         self.assertEqual(res.status_code, 302)
-        self.assertEqual(res.url, "http://zulip.testserver")
+        self.assertEqual(res["Location"], "http://zulip.testserver")
         res = test_redirect_to_next_url("/user_uploads/path_to_image")
         self.assertEqual(res.status_code, 302)
-        self.assertEqual(res.url, "http://zulip.testserver/user_uploads/path_to_image")
+        self.assertEqual(res["Location"], "http://zulip.testserver/user_uploads/path_to_image")
 
         res = test_redirect_to_next_url("/#narrow/stream/7-test-here")
         self.assertEqual(res.status_code, 302)
-        self.assertEqual(res.url, "http://zulip.testserver/#narrow/stream/7-test-here")
+        self.assertEqual(res["Location"], "http://zulip.testserver/#narrow/stream/7-test-here")
 
     def test_log_into_subdomain_when_token_is_malformed(self) -> None:
         data: ExternalAuthDataDict = {
@@ -4241,8 +4247,8 @@ class GoogleAuthBackendTest(SocialAuthBase):
         confirmation = Confirmation.objects.all().first()
         assert confirmation is not None
         confirmation_key = confirmation.confirmation_key
-        self.assertIn("do_confirm/" + confirmation_key, result.url)
-        result = self.client_get(result.url)
+        self.assertIn("do_confirm/" + confirmation_key, result["Location"])
+        result = self.client_get(result["Location"])
         self.assert_in_response('action="/accounts/register/"', result)
         confirmation_data = {
             "from_confirmation": "1",
@@ -4335,8 +4341,8 @@ class GoogleAuthBackendTest(SocialAuthBase):
         confirmation = Confirmation.objects.all().last()
         assert confirmation is not None
         confirmation_key = confirmation.confirmation_key
-        self.assertIn("do_confirm/" + confirmation_key, result.url)
-        result = self.client_get(result.url)
+        self.assertIn("do_confirm/" + confirmation_key, result["Location"])
+        result = self.client_get(result["Location"])
         self.assert_in_response('action="/accounts/register/"', result)
         data2 = {"from_confirmation": "1", "full_name": data["full_name"], "key": confirmation_key}
         result = self.client_post("/accounts/register/", data2, subdomain="zulip")
@@ -4966,7 +4972,7 @@ class TestDevAuthBackend(ZulipTestCase):
         data = {"prefers_web_public_view": "Anonymous login"}
         result = self.client_post("/accounts/login/local/", data)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "http://zulip.testserver/")
+        self.assertEqual(result["Location"], "http://zulip.testserver/")
 
     def test_login_success_with_2fa(self) -> None:
         user_profile = self.example_user("hamlet")
@@ -4976,7 +4982,7 @@ class TestDevAuthBackend(ZulipTestCase):
         with self.settings(TWO_FACTOR_AUTHENTICATION_ENABLED=True):
             result = self.client_post("/accounts/login/local/", data)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "http://zulip.testserver/")
+        self.assertEqual(result["Location"], "http://zulip.testserver/")
         self.assert_logged_in_user_id(user_profile.id)
         self.assertIn("otp_device_id", list(self.client.session.keys()))
 
@@ -4988,11 +4994,11 @@ class TestDevAuthBackend(ZulipTestCase):
 
         res = do_local_login("/accounts/login/local/")
         self.assertEqual(res.status_code, 302)
-        self.assertEqual(res.url, "http://zulip.testserver/")
+        self.assertEqual(res["Location"], "http://zulip.testserver/")
 
         res = do_local_login("/accounts/login/local/?next=/user_uploads/path_to_image")
         self.assertEqual(res.status_code, 302)
-        self.assertEqual(res.url, "http://zulip.testserver/user_uploads/path_to_image")
+        self.assertEqual(res["Location"], "http://zulip.testserver/user_uploads/path_to_image")
 
         # In local Email based authentication we never make browser send the hash
         # to the backend. Rather we depend upon the browser's behaviour of persisting
@@ -5000,7 +5006,7 @@ class TestDevAuthBackend(ZulipTestCase):
         # https://stackoverflow.com/questions/5283395/url-hash-is-persisting-between-redirects
         res = do_local_login("/accounts/login/local/?next=#narrow/stream/7-test-here")
         self.assertEqual(res.status_code, 302)
-        self.assertEqual(res.url, "http://zulip.testserver")
+        self.assertEqual(res["Location"], "http://zulip.testserver")
 
     def test_login_with_subdomain(self) -> None:
         user_profile = self.example_user("hamlet")
@@ -5032,7 +5038,7 @@ class TestDevAuthBackend(ZulipTestCase):
         data = {"new_realm": "zephyr"}
         result = self.client_post("/devlogin/", data, subdomain="zulip")
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "http://zephyr.testserver")
+        self.assertEqual(result["Location"], "http://zephyr.testserver")
 
         result = self.client_get("/devlogin/", subdomain="zephyr")
         self.assertEqual(result.status_code, 200)
@@ -5090,7 +5096,7 @@ class TestZulipRemoteUserBackend(DesktopFlowTestingLib, ZulipTestCase):
         )
         self.assertEqual(result.status_code, 302)
 
-        url = result.url
+        url = result["Location"]
         parsed_url = urllib.parse.urlparse(url)
         self.assertEqual(parsed_url.path, "/accounts/login/sso/")
         self.assertEqual(parsed_url.query, "param1=value1&params=value2")
@@ -5365,13 +5371,13 @@ class TestZulipRemoteUserBackend(DesktopFlowTestingLib, ZulipTestCase):
             return result
 
         res = test_with_redirect_to_param_set_as_next()
-        self.assertEqual("http://zulip.testserver", res.url)
+        self.assertEqual("http://zulip.testserver", res["Location"])
         res = test_with_redirect_to_param_set_as_next("/user_uploads/image_path")
-        self.assertEqual("http://zulip.testserver/user_uploads/image_path", res.url)
+        self.assertEqual("http://zulip.testserver/user_uploads/image_path", res["Location"])
 
         # Third-party domains are rejected and just send you to root domain
         res = test_with_redirect_to_param_set_as_next("https://rogue.zulip-like.server/login")
-        self.assertEqual("http://zulip.testserver", res.url)
+        self.assertEqual("http://zulip.testserver", res["Location"])
 
 
 class TestJWTLogin(ZulipTestCase):
@@ -6608,10 +6614,10 @@ class TestMaybeSendToRegistration(ZulipTestCase):
             confirmation = Confirmation.objects.all().first()
             assert confirmation is not None
             confirmation_key = confirmation.confirmation_key
-            self.assertIn("do_confirm/" + confirmation_key, result.url)
+            self.assertIn("do_confirm/" + confirmation_key, result["Location"])
             self.assertEqual(PreregistrationUser.objects.all().count(), 1)
 
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         self.assert_in_response('action="/accounts/register/"', result)
         self.assert_in_response(f'value="{confirmation_key}" name="key"', result)
 
@@ -6643,7 +6649,7 @@ class TestMaybeSendToRegistration(ZulipTestCase):
             confirmation = Confirmation.objects.all().last()
             assert confirmation is not None
             confirmation_key = confirmation.confirmation_key
-            self.assertIn("do_confirm/" + confirmation_key, result.url)
+            self.assertIn("do_confirm/" + confirmation_key, result["Location"])
             self.assertEqual(PreregistrationUser.objects.all().count(), 1)
 
 
diff --git a/zerver/tests/test_create_video_call.py b/zerver/tests/test_create_video_call.py
index b92290784d..8f3efb7f6b 100644
--- a/zerver/tests/test_create_video_call.py
+++ b/zerver/tests/test_create_video_call.py
@@ -85,8 +85,8 @@ class TestVideoCall(ZulipTestCase):
             {"code": "code", "state": '{"realm":"zephyr","sid":"somesid"}'},
         )
         self.assertEqual(response.status_code, 302)
-        self.assertIn("http://zephyr.testserver/", response.url)
-        self.assertIn("somesid", response.url)
+        self.assertIn("http://zephyr.testserver/", response["Location"])
+        self.assertIn("somesid", response["Location"])
 
     def test_create_video_sid_error(self) -> None:
         response = self.client_get(
@@ -214,7 +214,7 @@ class TestVideoCall(ZulipTestCase):
         self.assertEqual(response.status_code, 302)
         self.assertEqual(isinstance(response, HttpResponseRedirect), True)
         self.assertEqual(
-            response.url,
+            response["Location"],
             "https://bbb.example.com/bigbluebutton/api/join?meetingID=a&"
             "password=a&fullName=King%20Hamlet&createTime=0&checksum=47ca959b4ff5c8047a5a56d6e99c07e17eac43dbf792afc0a2a9f6491ec0048b",
         )
diff --git a/zerver/tests/test_home.py b/zerver/tests/test_home.py
index dc9056862c..d77109ecc3 100644
--- a/zerver/tests/test_home.py
+++ b/zerver/tests/test_home.py
@@ -318,7 +318,7 @@ class HomeTest(ZulipTestCase):
         # Redirect to login if spectator access is disabled.
         result = self.client_get("/")
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "/login/")
+        self.assertEqual(result["Location"], "/login/")
 
         # Load webapp directly if spectator access is enabled.
         do_set_realm_property(realm, "enable_spectator_access", True, acting_user=None)
diff --git a/zerver/tests/test_signup.py b/zerver/tests/test_signup.py
index 95a5af851f..f4725358f4 100644
--- a/zerver/tests/test_signup.py
+++ b/zerver/tests/test_signup.py
@@ -176,7 +176,7 @@ class DeactivationNoticeTestCase(ZulipTestCase):
         for url in ("/register/", "/login/"):
             result = self.client_get(url)
             self.assertEqual(result.status_code, 302)
-            self.assertIn("deactivated", result.url)
+            self.assertIn("deactivated", result["Location"])
 
     def test_redirection_for_active_realm(self) -> None:
         for url in ("/register/", "/login/"):
@@ -186,7 +186,7 @@ class DeactivationNoticeTestCase(ZulipTestCase):
     def test_deactivation_notice_when_realm_is_active(self) -> None:
         result = self.client_get("/accounts/deactivated/")
         self.assertEqual(result.status_code, 302)
-        self.assertIn("login", result.url)
+        self.assertIn("login", result["Location"])
 
     def test_deactivation_notice_when_deactivated(self) -> None:
         realm = get_realm("zulip")
@@ -403,9 +403,11 @@ class PasswordResetTest(ZulipTestCase):
         )
         result = self.client_get(password_reset_url)
         self.assertEqual(result.status_code, 302)
-        self.assertTrue(result.url.endswith(f"/{PasswordResetConfirmView.reset_url_token}/"))
+        self.assertTrue(
+            result["Location"].endswith(f"/{PasswordResetConfirmView.reset_url_token}/")
+        )
 
-        final_reset_url = result.url
+        final_reset_url = result["Location"]
         result = self.client_get(final_reset_url)
         self.assertEqual(result.status_code, 200)
 
@@ -440,7 +442,9 @@ class PasswordResetTest(ZulipTestCase):
         with self.settings(ROOT_DOMAIN_LANDING_PAGE=True, ROOT_SUBDOMAIN_ALIASES=["alias"]):
             result = self.client_get("/accounts/password/reset/")
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/?next=%2Faccounts%2Fpassword%2Freset%2F")
+            self.assertEqual(
+                result["Location"], "/accounts/go/?next=%2Faccounts%2Fpassword%2Freset%2F"
+            )
 
         mock_get_host.return_value = "www.testserver"
         with self.settings(
@@ -448,7 +452,9 @@ class PasswordResetTest(ZulipTestCase):
         ):
             result = self.client_get("/accounts/password/reset/")
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/?next=%2Faccounts%2Fpassword%2Freset%2F")
+            self.assertEqual(
+                result["Location"], "/accounts/go/?next=%2Faccounts%2Fpassword%2Freset%2F"
+            )
 
     @patch("django.http.HttpRequest.get_host")
     def test_password_reset_page_redirects_for_root_domain_when_root_domain_landing_page_is_enabled(
@@ -458,7 +464,9 @@ class PasswordResetTest(ZulipTestCase):
         with self.settings(ROOT_DOMAIN_LANDING_PAGE=True):
             result = self.client_get("/accounts/password/reset/")
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/?next=%2Faccounts%2Fpassword%2Freset%2F")
+            self.assertEqual(
+                result["Location"], "/accounts/go/?next=%2Faccounts%2Fpassword%2Freset%2F"
+            )
 
         mock_get_host.return_value = "www.testserver.com"
         with self.settings(
@@ -467,7 +475,9 @@ class PasswordResetTest(ZulipTestCase):
         ):
             result = self.client_get("/accounts/password/reset/")
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/?next=%2Faccounts%2Fpassword%2Freset%2F")
+            self.assertEqual(
+                result["Location"], "/accounts/go/?next=%2Faccounts%2Fpassword%2Freset%2F"
+            )
 
     @patch("django.http.HttpRequest.get_host")
     def test_password_reset_page_works_for_root_alias_when_root_domain_landing_page_is_not_enabled(
@@ -912,7 +922,7 @@ class LoginTest(ZulipTestCase):
             "/accounts/home/", {"email": self.nonreg_email("test")}, subdomain="zulip"
         )
         self.assertEqual(result.status_code, 302)
-        self.assertEqual("/accounts/deactivated/", result.url)
+        self.assertEqual("/accounts/deactivated/", result["Location"])
 
         with self.assertRaises(UserProfile.DoesNotExist):
             self.nonreg_user("test")
@@ -936,7 +946,7 @@ class LoginTest(ZulipTestCase):
         email = self.nonreg_email("test")
         result = self.client_post("/accounts/home/", {"email": email}, subdomain="zulip")
         self.assertEqual(result.status_code, 302)
-        self.assertNotIn("deactivated", result.url)
+        self.assertNotIn("deactivated", result["Location"])
 
         realm = get_realm("zulip")
         realm.deactivated = True
@@ -944,7 +954,7 @@ class LoginTest(ZulipTestCase):
 
         result = self.submit_reg_form_for_user(email, "abcd1234", subdomain="zulip")
         self.assertEqual(result.status_code, 302)
-        self.assertEqual("/accounts/deactivated/", result.url)
+        self.assertEqual("/accounts/deactivated/", result["Location"])
 
         with self.assertRaises(UserProfile.DoesNotExist):
             self.nonreg_user("test")
@@ -959,7 +969,7 @@ class LoginTest(ZulipTestCase):
 
         result = self.login_with_return(self.example_email("hamlet"), subdomain="zulip")
         self.assertEqual(result.status_code, 302)
-        self.assertEqual("/accounts/deactivated/", result.url)
+        self.assertEqual("/accounts/deactivated/", result["Location"])
 
     def test_logout(self) -> None:
         self.login("hamlet")
@@ -2259,7 +2269,7 @@ so we didn't send them an invitation. We did send invitations to everyone else!"
         )
         self.assertEqual(response.status_code, 302)
         self.assertEqual(
-            response.url,
+            response["Location"],
             reverse("login") + "?" + urlencode({"email": email, "already_registered": 1}),
         )
 
@@ -2280,7 +2290,7 @@ so we didn't send them an invitation. We did send invitations to everyone else!"
         )
         response = self.submit_reg_form_for_user(email, "password", key=registration_key)
         self.assertEqual(response.status_code, 302)
-        self.assertEqual(response.url, "http://zulip.testserver/")
+        self.assertEqual(response["Location"], "http://zulip.testserver/")
 
         self.subscribe_realm_to_monthly_plan_on_manual_license_management(realm, 5, 5)
 
@@ -3341,9 +3351,9 @@ class RealmCreationTest(ZulipTestCase):
         )
         self.assertEqual(result.status_code, 302)
 
-        result = self.client_get(result.url, subdomain=string_id)
+        result = self.client_get(result["Location"], subdomain=string_id)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "http://zuliptest.testserver")
+        self.assertEqual(result["Location"], "http://zuliptest.testserver")
 
         # Make sure the realm is created
         realm = get_realm(string_id)
@@ -3385,9 +3395,9 @@ class RealmCreationTest(ZulipTestCase):
         )
         self.assertEqual(result.status_code, 302)
 
-        result = self.client_get(result.url, subdomain=string_id)
+        result = self.client_get(result["Location"], subdomain=string_id)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "http://zuliptest.testserver")
+        self.assertEqual(result["Location"], "http://zuliptest.testserver")
 
         # Make sure the realm is created
         realm = get_realm(string_id)
@@ -3439,9 +3449,9 @@ class RealmCreationTest(ZulipTestCase):
         )
         self.assertEqual(result.status_code, 302)
 
-        result = self.client_get(result.url, subdomain=string_id)
+        result = self.client_get(result["Location"], subdomain=string_id)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "http://zuliptest.testserver")
+        self.assertEqual(result["Location"], "http://zuliptest.testserver")
 
         # Make sure the realm is created
         realm = get_realm(string_id)
@@ -3482,9 +3492,9 @@ class RealmCreationTest(ZulipTestCase):
         )
         self.assertEqual(result.status_code, 302)
 
-        result = self.client_get(result.url, subdomain=string_id)
+        result = self.client_get(result["Location"], subdomain=string_id)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "http://zuliptest.testserver")
+        self.assertEqual(result["Location"], "http://zuliptest.testserver")
 
         # Make sure the realm is created
         realm = get_realm(string_id)
@@ -3589,10 +3599,10 @@ class RealmCreationTest(ZulipTestCase):
         )
         self.assertEqual(result.status_code, 302)
 
-        result = self.client_get(result.url, subdomain=string_id)
-        self.assertEqual(result.url, "http://zuliptest.testserver/upgrade/?onboarding=true")
+        result = self.client_get(result["Location"], subdomain=string_id)
+        self.assertEqual(result["Location"], "http://zuliptest.testserver/upgrade/?onboarding=true")
 
-        result = self.client_get(result.url, subdomain=string_id)
+        result = self.client_get(result["Location"], subdomain=string_id)
         self.assert_in_success_response(["Not ready to start your trial?"], result)
 
         realm = get_realm(string_id)
@@ -3717,7 +3727,9 @@ class RealmCreationTest(ZulipTestCase):
             email, password, realm_subdomain="a-0", realm_name=realm_name
         )
         self.assertEqual(result.status_code, 302)
-        self.assertTrue(result.url.startswith("http://a-0.testserver/accounts/login/subdomain/"))
+        self.assertTrue(
+            result["Location"].startswith("http://a-0.testserver/accounts/login/subdomain/")
+        )
 
     @override_settings(OPEN_REALM_CREATION=True)
     def test_create_realm_using_old_subdomain_of_a_realm(self) -> None:
@@ -3760,7 +3772,9 @@ class RealmCreationTest(ZulipTestCase):
             email, password, realm_subdomain="", realm_name=realm_name
         )
         self.assertEqual(result.status_code, 302)
-        self.assertTrue(result.url.startswith("http://testserver/accounts/login/subdomain/"))
+        self.assertTrue(
+            result["Location"].startswith("http://testserver/accounts/login/subdomain/")
+        )
 
     @override_settings(OPEN_REALM_CREATION=True)
     def test_subdomain_restrictions_root_domain_option(self) -> None:
@@ -3793,7 +3807,9 @@ class RealmCreationTest(ZulipTestCase):
             realm_name=realm_name,
         )
         self.assertEqual(result.status_code, 302)
-        self.assertTrue(result.url.startswith("http://testserver/accounts/login/subdomain/"))
+        self.assertTrue(
+            result["Location"].startswith("http://testserver/accounts/login/subdomain/")
+        )
 
     def test_is_root_domain_available(self) -> None:
         self.assertTrue(is_root_domain_available())
@@ -4046,7 +4062,7 @@ class UserSignUpTest(InviteUserBase):
         result = self.client_post("/accounts/home/", {"email": email})
         self.assertEqual(result.status_code, 302)
         self.assertIn("login", result["Location"])
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         self.assert_in_response("You've already registered", result)
 
     def test_signup_system_bot(self) -> None:
@@ -4054,7 +4070,7 @@ class UserSignUpTest(InviteUserBase):
         result = self.client_post("/accounts/home/", {"email": email}, subdomain="lear")
         self.assertEqual(result.status_code, 302)
         self.assertIn("login", result["Location"])
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
 
         # This is not really the right error message, but at least it's an error.
         self.assert_in_response("You've already registered", result)
@@ -4813,7 +4829,7 @@ class UserSignUpTest(InviteUserBase):
             with self.assertRaises(UserProfile.DoesNotExist):
                 user_profile = UserProfile.objects.get(delivery_email=email)
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/login/?email=newuser%40zulip.com")
+            self.assertEqual(result["Location"], "/accounts/login/?email=newuser%40zulip.com")
 
             # Submit the final form with the correct password.
             result = self.submit_reg_form_for_user(
@@ -5070,7 +5086,7 @@ class UserSignUpTest(InviteUserBase):
             )
             self.assertEqual(result.status_code, 302)
             # We get redirected back to the login page because password was wrong
-            self.assertEqual(result.url, "/accounts/login/?email=newuser%40zulip.com")
+            self.assertEqual(result["Location"], "/accounts/login/?email=newuser%40zulip.com")
             self.assertFalse(UserProfile.objects.filter(delivery_email=email).exists())
 
         # For the rest of the test we delete the user from ldap.
@@ -5093,7 +5109,7 @@ class UserSignUpTest(InviteUserBase):
             self.assertEqual(result.status_code, 302)
             # We get redirected back to the login page because emails matching LDAP_APPEND_DOMAIN,
             # aren't allowed to create non-LDAP accounts.
-            self.assertEqual(result.url, "/accounts/login/?email=newuser%40zulip.com")
+            self.assertEqual(result["Location"], "/accounts/login/?email=newuser%40zulip.com")
             self.assertFalse(UserProfile.objects.filter(delivery_email=email).exists())
             self.assertEqual(
                 debug_log.output,
@@ -5137,7 +5153,7 @@ class UserSignUpTest(InviteUserBase):
                 ],
             )
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "http://zulip.testserver/")
+            self.assertEqual(result["Location"], "http://zulip.testserver/")
             user_profile = UserProfile.objects.get(delivery_email=email)
             # Name comes from the POST request, not LDAP
             self.assertEqual(user_profile.full_name, "Non-LDAP Full Name")
@@ -5190,7 +5206,7 @@ class UserSignUpTest(InviteUserBase):
             )
             self.assertEqual(result.status_code, 302)
             # We get redirected back to the login page because password was wrong
-            self.assertEqual(result.url, "/accounts/login/?email=newuser_email%40zulip.com")
+            self.assertEqual(result["Location"], "/accounts/login/?email=newuser_email%40zulip.com")
             self.assertFalse(UserProfile.objects.filter(delivery_email=email).exists())
 
         # If the user's email is not in the LDAP directory , though, we
@@ -5243,7 +5259,7 @@ class UserSignUpTest(InviteUserBase):
                 ],
             )
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "http://zulip.testserver/")
+            self.assertEqual(result["Location"], "http://zulip.testserver/")
             user_profile = UserProfile.objects.get(delivery_email=email)
             # Name comes from the POST request, not LDAP
             self.assertEqual(user_profile.full_name, "Non-LDAP Full Name")
@@ -5660,11 +5676,11 @@ class TestLoginPage(ZulipTestCase):
         with self.settings(ROOT_DOMAIN_LANDING_PAGE=True):
             result = self.client_get("/en/login/")
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/")
+            self.assertEqual(result["Location"], "/accounts/go/")
 
             result = self.client_get("/en/login/", {"next": "/upgrade/"})
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/?next=%2Fupgrade%2F")
+            self.assertEqual(result["Location"], "/accounts/go/?next=%2Fupgrade%2F")
 
     @patch("django.http.HttpRequest.get_host")
     def test_login_page_redirects_for_root_domain(self, mock_get_host: MagicMock) -> None:
@@ -5672,11 +5688,11 @@ class TestLoginPage(ZulipTestCase):
         with self.settings(ROOT_DOMAIN_LANDING_PAGE=True):
             result = self.client_get("/en/login/")
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/")
+            self.assertEqual(result["Location"], "/accounts/go/")
 
             result = self.client_get("/en/login/", {"next": "/upgrade/"})
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/?next=%2Fupgrade%2F")
+            self.assertEqual(result["Location"], "/accounts/go/?next=%2Fupgrade%2F")
 
         mock_get_host.return_value = "www.testserver.com"
         with self.settings(
@@ -5686,11 +5702,11 @@ class TestLoginPage(ZulipTestCase):
         ):
             result = self.client_get("/en/login/")
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/")
+            self.assertEqual(result["Location"], "/accounts/go/")
 
             result = self.client_get("/en/login/", {"next": "/upgrade/"})
             self.assertEqual(result.status_code, 302)
-            self.assertEqual(result.url, "/accounts/go/?next=%2Fupgrade%2F")
+            self.assertEqual(result["Location"], "/accounts/go/?next=%2Fupgrade%2F")
 
     @patch("django.http.HttpRequest.get_host")
     def test_login_page_works_without_subdomains(self, mock_get_host: MagicMock) -> None:
@@ -5732,7 +5748,7 @@ class TestLoginPage(ZulipTestCase):
         session.save()
         result = self.client_get("http://auth.testserver/login/")
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, zulip_realm.uri)
+        self.assertEqual(result["Location"], zulip_realm.uri)
 
         session = self.client.session
         session["subdomain"] = "invalid"
@@ -5760,9 +5776,9 @@ class TestFindMyTeam(ZulipTestCase):
         )
         self.assertEqual(result.status_code, 302)
         self.assertEqual(
-            result.url, "/accounts/find/?emails=iago%40zulip.com%2CcordeliA%40zulip.com"
+            result["Location"], "/accounts/find/?emails=iago%40zulip.com%2CcordeliA%40zulip.com"
         )
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         content = result.content.decode()
         self.assertIn("Emails sent! You will only receive emails", content)
         self.assertIn("iago@zulip.com", content)
@@ -5783,9 +5799,10 @@ class TestFindMyTeam(ZulipTestCase):
         )
         self.assertEqual(result.status_code, 302)
         self.assertEqual(
-            result.url, "/accounts/find/?emails=iago%40zulip.com%2Cinvalid_email%40zulip.com"
+            result["Location"],
+            "/accounts/find/?emails=iago%40zulip.com%2Cinvalid_email%40zulip.com",
         )
-        result = self.client_get(result.url)
+        result = self.client_get(result["Location"])
         content = result.content.decode()
         self.assertIn("Emails sent! You will only receive emails", content)
         self.assertIn(self.example_email("iago"), content)
@@ -5819,7 +5836,7 @@ class TestFindMyTeam(ZulipTestCase):
         data = {"emails": self.example_email("hamlet")}
         result = self.client_post("/accounts/find/", data)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "/accounts/find/?emails=hamlet%40zulip.com")
+        self.assertEqual(result["Location"], "/accounts/find/?emails=hamlet%40zulip.com")
         from django.core.mail import outbox
 
         self.assert_length(outbox, 1)
@@ -5829,7 +5846,7 @@ class TestFindMyTeam(ZulipTestCase):
         data = {"emails": self.example_email("hamlet")}
         result = self.client_post("/accounts/find/", data)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "/accounts/find/?emails=hamlet%40zulip.com")
+        self.assertEqual(result["Location"], "/accounts/find/?emails=hamlet%40zulip.com")
         from django.core.mail import outbox
 
         self.assert_length(outbox, 0)
@@ -5839,7 +5856,7 @@ class TestFindMyTeam(ZulipTestCase):
         data = {"emails": self.example_email("hamlet")}
         result = self.client_post("/accounts/find/", data)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "/accounts/find/?emails=hamlet%40zulip.com")
+        self.assertEqual(result["Location"], "/accounts/find/?emails=hamlet%40zulip.com")
         from django.core.mail import outbox
 
         self.assert_length(outbox, 0)
@@ -5848,7 +5865,7 @@ class TestFindMyTeam(ZulipTestCase):
         data = {"emails": self.example_email("webhook_bot")}
         result = self.client_post("/accounts/find/", data)
         self.assertEqual(result.status_code, 302)
-        self.assertEqual(result.url, "/accounts/find/?emails=webhook-bot%40zulip.com")
+        self.assertEqual(result["Location"], "/accounts/find/?emails=webhook-bot%40zulip.com")
         from django.core.mail import outbox
 
         self.assert_length(outbox, 0)
diff --git a/zerver/tests/test_thumbnail.py b/zerver/tests/test_thumbnail.py
index 7432a2c869..42d0de963f 100644
--- a/zerver/tests/test_thumbnail.py
+++ b/zerver/tests/test_thumbnail.py
@@ -23,7 +23,7 @@ class ThumbnailTest(ZulipTestCase):
 
         result = self.client_get("/thumbnail", {"url": uri[1:], "size": "full"})
         self.assertEqual(result.status_code, 302, result)
-        self.assertEqual(uri, result.url)
+        self.assertEqual(uri, result["Location"])
 
         self.login("iago")
         result = self.client_get("/thumbnail", {"url": uri[1:], "size": "full"})
@@ -34,19 +34,19 @@ class ThumbnailTest(ZulipTestCase):
         result = self.client_get("/thumbnail", {"url": uri, "size": "full"})
         self.assertEqual(result.status_code, 302, result)
         base = "https://external-content.zulipcdn.net/external_content/56c362a24201593891955ff526b3b412c0f9fcd2/68747470733a2f2f7777772e676f6f676c652e636f6d2f696d616765732f737270722f6c6f676f34772e706e67"
-        self.assertEqual(base, result.url)
+        self.assertEqual(base, result["Location"])
 
         uri = "http://www.google.com/images/srpr/logo4w.png"
         result = self.client_get("/thumbnail", {"url": uri, "size": "full"})
         self.assertEqual(result.status_code, 302, result)
         base = "https://external-content.zulipcdn.net/external_content/7b6552b60c635e41e8f6daeb36d88afc4eabde79/687474703a2f2f7777772e676f6f676c652e636f6d2f696d616765732f737270722f6c6f676f34772e706e67"
-        self.assertEqual(base, result.url)
+        self.assertEqual(base, result["Location"])
 
         uri = "//www.google.com/images/srpr/logo4w.png"
         result = self.client_get("/thumbnail", {"url": uri, "size": "full"})
         self.assertEqual(result.status_code, 302, result)
         base = "https://external-content.zulipcdn.net/external_content/676530cf4b101d56f56cc4a37c6ef4d4fd9b0c03/2f2f7777772e676f6f676c652e636f6d2f696d616765732f737270722f6c6f676f34772e706e67"
-        self.assertEqual(base, result.url)
+        self.assertEqual(base, result["Location"])
 
     @override_settings(RATE_LIMITING=True)
     def test_thumbnail_redirect_for_spectator(self) -> None: