3.1.2.2. 注册要求(3.1.2.2. Registration Requirements)

3.1.2.2. 注册要求

授权服务器必须要求下列客户端注册它们的重定向端点：

• 公开客户端。
• 采用隐式许可类型的机密客户端。

授权服务器应该要求所有客户端在使用授权端点前注册它们的重定向端点。

授权服务器应该要求客户端提供完整的重定向URI（客户端可以使用“state”请求参数实现每请求自定义）。如果要求完整的重定向URI注册不可行，授权服务器应该要求注册URI方案、授权和路径（当请求授权时只允许客户端动态改变重定向URI的查询部分）。

授权服务器可以允许客户端注册多个重定向端点。

缺少重定向URI注册的要求，可能使攻击者如10.15所述将授权端点用作自由重定向端点。

3.1.2.2. Registration Requirements

   The authorization server MUST require the following clients to
   register their redirection endpoint:

   o  Public clients.

   o  Confidential clients utilizing the implicit grant type.

   The authorization server SHOULD require all clients to register their
   redirection endpoint prior to utilizing the authorization endpoint.

   The authorization server SHOULD require the client to provide the
   complete redirection URI (the client MAY use the "state" request
   parameter to achieve per-request customization).  If requiring the
   registration of the complete redirection URI is not possible, the
   authorization server SHOULD require the registration of the URI
   scheme, authority, and path (allowing the client to dynamically vary
   only the query component of the redirection URI when requesting
   authorization).

   The authorization server MAY allow the client to register multiple
   redirection endpoints.

   Lack of a redirection URI registration requirement can enable an
   attacker to use the authorization endpoint as an open redirector as
   described in Section 10.15.