def login():
    callback = url_for(".callback", _external=True)
    next_path = request.args.get(
        "next", url_for("redash.index", org_slug=session.get("org_slug"))
    )
    logger.debug("Callback url: %s", callback)
    logger.debug("Next is: %s", next_path)
    return google_remote_app().authorize(callback=callback, state=next_path)
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.