Allow additional safe hosts for "next" parameter during login

[Jon Dufresne]

Use case:

• Django application using auth for authentication
• Django application is one part of a loosely coupled network of applications written in multiple languages/frameworks
• These other applications are hosted on different domains
• Goal, upon successful login, Django should be able to redirect to these other applications

To solve this use case I propose the following changes:

• Change is_safe_url() so the host argument can also accept a list of hosts.
• Change LoginView to add a new class member allowed_hosts. This member is a list of allowed hosts to pass to is_safe_url() in LoginView.get_success_url(). I think self.request.get_host() will always be implicitly added to this list.

[Simon Charette]

As allowed_hosts would only be used by the get_success_url() method I suggest giving the class member or method a more explicit name (get_success_url_allowed_hosts()?)

[Jon Dufresne]

​PR

[Jon Dufresne <jon.dufresne@…>]

In f227b8d:

Refs #26956 -- Allowed is_safe_url() to validate against multiple hosts

[Jon Dufresne <jon.dufresne@…>]

In 66e1ebbf:

Fixed #26956 -- Added success_url_allowed_hosts to LoginView and LogoutView.

Allows specifying additional hosts to redirect after login and log out.

[Tim Graham <timograham@…>]

In 96107e2:

Refs #26956 -- Removed the host parameter of django.utils.http.is_safe_url().

Per deprecation timeline.