def on_permitted_domain(team: Team, request: HttpRequest) -> bool:
    permitted_domains = ["127.0.0.1", "localhost"]

    for url in team.app_urls:
        hostname = parse_domain(url)
        if hostname:
            permitted_domains.append(hostname)

    origin = parse_domain(request.headers.get("Origin"))
    referer = parse_domain(request.headers.get("Referer"))
    for permitted_domain in permitted_domains:
        if "*" in permitted_domain:
            pattern = "^{}$".format(permitted_domain.replace(".", "\\.").replace("*", "(.*)"))
            if (origin and re.search(pattern, origin)) or (referer and re.search(pattern, referer)):
                return True
        else:
            if permitted_domain == origin or permitted_domain == referer:
                return True
    return False
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.