「应用安全」OAuth和OpenID Connect的全面比较(27)_1.简介在这篇文章中

{
// RFC 6749 3.1.2.2. Registration Requirements says
// as follows:
//
// The authorization server MUST require the
// following clients to register their
// redirection endpoint:
//
// o Public clients.
// o Confidential clients utilizing the
// implicit grant type.
// If the type of the client application which made
// the authorization request is 'public'.
if ( client.getClientType() == PUBLIC )
{
throw new Exception(
\"A redirect URI must be registered.\");

// If the client type is 'confidential' and if the
// authorization flow is 'Implicit Flow'. If the
// 'response_type' request parameter contains either
// or both of 'token' and 'id_token' the flow should
// be treated as a kind of 'Implicit Flow'.
else if ( responseType.requiresImplicitFlow() )
{
throw new Exception(
\"A redirect URI must be registered.\");

// If the authorization request does not contain the
// 'redirect_uri' request parameter.