I don't like this one. 
You're allowing it to potentially become `''` but then you send it to a function (`urlparse()`) which is expecting a URL as the input. At this point we're just lucky that `urlparse()` doesn't barf on an empty string.

Perhaps we can go:

```python
# Security checks are done, we can log in now.
auth.login(self.request, self.user)

redirect_to = self.request.REQUEST.get(redirect_field_name)
if redirect_to:
    netloc = urlparse(redirect_to).netloc
    if netloc and netloc != self.request.get_host():
        # a full URL was attempted but it's for a different domain
        redirect_to = None
return HttpResponseRedirect(redirect_to or self.get_success_url())
```

This way, also, the `auth.login()` stuff isn't in the middle of the redirect stuff.