Repository: mdn/kuma

Issue:
Make ?next=... respect the Yari local dev hostname
**Summary**
When you go to `http://localhost.org:8000/users/github/login/?next=$NEXT` that `$NEXT` can't contain a hostname that is different from `localhost.org:8000` or else it gets dropped. For (good) security reasons. 
We need to be able to override that for when you're doing local development in Yari with authentication.

**Audience**
Dev. 


**Rationale**
We want to be very strict,  careful, and deliberate. Aka. it's tied down hard to very specific things and ONLY when doing *local* Kuma development. 


**Workaround**
If this doesn't work, when you start up Yari (http://localhost.org:3000) and click sign in, you have to manually edit the addressbar to go back to `:3000` instead of `:8000`. 


**Proposal**
I have a hack in mind already that I know works. 


**Additional context**
It doesn't have to be perfect because it's going to be made very explicit and exclusively only for the select few "hardcore" developers who work on Yari with authentication. 



Discussion:

Resolving patch:
diff --git a/kuma/settings/common.py b/kuma/settings/common.py
--- a/kuma/settings/common.py
+++ b/kuma/settings/common.py
@@ -1892,3 +1892,12 @@ def get_user_url(user):
 SENDINBLUE_LIST_ID = config("SENDINBLUE_LIST_ID", default=None)
 
 SITEMAP_USE_S3 = config("SITEMAP_USE_S3", cast=bool, default=True)
+
+# When doing local development with Yari, if you want to have `?next=...` redirects
+# work when you sign in on Yari, this needs to be set to `localhost.org:3000` in your
+# .env file. That tells, Kuma that if the `?next` URL is an absolute URL, that
+# it's safe to use and redirect to.
+# This additional host is always, also, dependent on settings.DEBUG==True.
+ADDITIONAL_NEXT_URL_ALLOWED_HOSTS = config(
+    "ADDITIONAL_NEXT_URL_ALLOWED_HOSTS", default=None
+)
diff --git a/kuma/users/adapters.py b/kuma/users/adapters.py
--- a/kuma/users/adapters.py
+++ b/kuma/users/adapters.py
@@ -7,11 +7,13 @@
 from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
 from allauth.socialaccount.models import SocialLogin
 from django import forms
+from django.conf import settings
 from django.contrib import messages
 from django.contrib.auth import get_user_model
 from django.db.models import Q
 from django.shortcuts import redirect, render
 from django.utils.cache import add_never_cache_headers
+from django.utils.http import is_safe_url
 from django.utils.translation import gettext_lazy as _
 from redo import retrying
 from waffle import switch_is_active
@@ -54,6 +56,17 @@ def is_open_for_signup(self, request):
         """
         return False
 
+    def is_safe_url(self, url):
+        """This method override exists for 1 single purpose; to make an exception
+        for the Yari development server."""
+        # The only difference between our override and the one in allauth is that
+        # we inject the extra `allowed_hosts=` which, in allauth, is hardcoded to
+        # be `allowed_hosts=None`.
+        allowed_hosts = None
+        if settings.DEBUG:
+            allowed_hosts = settings.ADDITIONAL_NEXT_URL_ALLOWED_HOSTS
+        return is_safe_url(url, allowed_hosts=allowed_hosts)
+
     def clean_username(self, username):
         """
         When signing up make sure the username isn't already used by


Test patch: