    def _deny_hook(self, resource=None):
        app = self.get_app()
        if current_user.is_authenticated():
            status = 403
        else:
            status = 401
        #abort(status)

        if app.config.get('FRONTED_BY_NGINX'):
                url = "https://{}:{}{}".format(app.config.get('FQDN'), app.config.get('NGINX_PORT'), '/login')
        else:
                url = "http://{}:{}{}".format(app.config.get('FQDN'), app.config.get('API_PORT'), '/login')
        if current_user.is_authenticated():
            auth_dict = {
                "authenticated": True,
                "user": current_user.email,
                "roles": current_user.role,
            }
        else:
            auth_dict = {
                "authenticated": False,
                "user": None,
                "url": url
            }

        return Response(response=json.dumps({"auth": auth_dict}), status=status, mimetype="application/json")
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.