White list any 302 locations

check_redirect.py

from flask import make_response
from urllib.parse import urlparse

# domain:port
SAFE_DOMAINS = ['ziade.org:443']


@app.after_request
def check_redirect(response):
    if response.status_code != 302:
        return response

    url = urlparse(response.location)
    netloc = url.netloc

    if url.scheme == 'http' and not netloc.endswith(':80'):
         netloc += ':80'

    if url.scheme == 'https' and not netloc.endswith(':443'):
        netloc += ':443'

    if netloc not in SAFE_DOMAINS:
        # not using abort() here or it'll break the hook
        return make_response('Forbidden', 403)

    return response