title: Is it safe to store my 'next' url in a signed cookie and redirect to it carefree?
body: <p>I'm using Flask and it's occurred to me it could be a rather elegant solution to redirect back to the user's last page after login/logout by simply placing a <code>session['next'] = request.url</code> at each endpoint of my application and to just have my login/logout functions redirect right to <code>session.get('next')</code>. This is even similar to an option in the Flask-Login extension if you enable <code>USE_SESSION_FOR_NEXT.</code></p>
  
  <p>I would like to confirm this is a safe workflow but am not security-savvy to recognize if there are any ways to spoof the request.url or if I should still be validating the next url prior to redirecting, as is specified here: </p>
  
  <blockquote>
    <p><a href="http://flask.pocoo.org/snippets/62/" rel="noreferrer">http://flask.pocoo.org/snippets/62/</a></p>
  </blockquote>
  
  <p>Is there a reason this method is not more commonly deployed? It seems like a nice, clean, easy solution that keeps URL's clean, minimizes for fields/processing, and removes a vulnerability to open redirect attacks if you are not taking the extra steps to validate the next url. What's the catch?</p>