I am reading this blog post about an vulnerability on uber.com. It says that you will have to set a content security policy:
We’ll set our policy to only allow requests to partners.uber.com, which will block
https://login.uber.com/logout/*Hence a 302 redirect to
https://login.uber.com/logout/will be prevented.