def test_login_next_url_spoofed_host_header_allowed(self):
        """
        Ensure a spoofed Host header does not allow redirection to an untrusted domain
        """
        self.browser_logout(self.client)

        response = self.browser_login(
            self.client,
            USERNAME_ADMIN,
            PASSWORD_ADMIN,
            next_url="https://example.com/",
            follow_redirects=False,
            headers={"Host": "example.com"},
        )

        assert response.status_code == 302
        assert response.location == "https://example.com/"

        Ensure a spoofed Host header does not allow redirection to an untrusted domain
        
tests/security/test_mvc_security.py