def custom_logout(request, **kwargs):
    if not request.user.is_authenticated:
        return redirect(request.GET.get('next', reverse(settings.LOGIN_URL)))

    if request.method == 'POST':
        return _logout_view(request, **kwargs)

    return render(request, 'spirit/user/auth/logout.html')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.