「应用安全」OAuth和OpenID Connect的全面比较(32)_1.简介在这篇文章中

// If none of the registered redirect URI matches.
if ( registered == false )
{
throw new Exception(
\"The redirect URI is not registered.\");

// Check requirements by the 'application_type' of the client.// If the value of the 'application_type' attribute is 'web'.
if ( client.getApplicationType() == WEB )
{
// If the authorization flow is 'Implicit Flow'. When the
// 'response_type' request parameter of the authorization
// request contains either or both of 'token' and 'id_token'
// it should be treated as a kind of 'Implicit Flow'.
if ( responseType.requiresImplicitFlow() )
{
// If the scheme of the redirect URI is not 'https'.
if ( \"https\".equals( redirectUri.getScheme() ) == false )
{
// The scheme part of the redirect URI must be
// 'https' when a client application whose
// 'application_type' is 'web' uses 'Implicit Flow'.
throw new Exception(
\"The scheme of the redirect URI is not 'https'.\");

// If the host of the redirect URI is 'localhost'.