3.1.2.1. 端点请求的机密性(3.1.2.1. Endpoint Request Confidentiality)

3.1.2.1. 端点请求的机密性

当所请求的响应类型是“code”或“token”时，或者当重定向请求将引起机密凭据通过公开网络传输时，重定向端点应该要求使用1.6节所述的TLS。本规范没有强制使用TLS，因为在撰写本规范时，要求客户端部署TLS对于许多客户端开发者是一严重的困难。如果TLS不可用，授权服务器应该在重定向之前警告资源所有者有关非安全端点（例如，在授权请求期间现实一条信息）。

缺乏传输层安全可能对客户端及它被授权访问的受保护资源的安全具有严重影响。当授权过程用作一种客户端委托的对最终用户认证（例如，第三方登录服务）的形式时，使用传输层安全尤其关键。

3.1.2.1. Endpoint Request Confidentiality

   The redirection endpoint SHOULD require the use of TLS as described
   in Section 1.6 when the requested response type is "code" or "token",
   or when the redirection request will result in the transmission of
   sensitive credentials over an open network.  This specification does
   not mandate the use of TLS because at the time of this writing,
   requiring clients to deploy TLS is a significant hurdle for many
   client developers.  If TLS is not available, the authorization server
   SHOULD warn the resource owner about the insecure endpoint prior to
   redirection (e.g., display a message during the authorization
   request).

   Lack of transport-layer security can have a severe impact on the
   security of the client and the protected resources it is authorized
   to access.  The use of transport-layer security is particularly
   critical when the authorization process is used as a form of
   delegated end-user authentication by the client (e.g., third-party
   sign-in service).