3.1.2.5. 端点内容(3.1.2.5. Endpoint Content)

3.1.2.5. 端点内容

向客户端端点的重定向请求通常会引起由用户代理处理的HTML文档响应。如果HTML响应直接作为重定向请求的服务结果，任何包含在HTML文档中的脚本将执行，并具有对重定向URI和其包含的凭据的完全访问权限。

客户端不应该在重定向端点的响应中包含任何第三方的脚本（例如，第三方分析、社交插件、广告网络）。相反，它应该从URI中提取凭据并向另一个端点重定向用户代理而不暴露凭据（在URI中或其他地方）。如果包含第三方脚本，客户端必须确保它自己的脚本（用于从URI中提取凭据并从URI中删除）将首先执行。

3.1.2.5. Endpoint Content

   The redirection request to the client's endpoint typically results in
   an HTML document response, processed by the user-agent.  If the HTML
   response is served directly as the result of the redirection request,
   any script included in the HTML document will execute with full
   access to the redirection URI and the credentials it contains.

   The client SHOULD NOT include any third-party scripts (e.g., third-
   party analytics, social plug-ins, ad networks) in the redirection
   endpoint response.  Instead, it SHOULD extract the credentials from
   the URI and redirect the user-agent again to another endpoint without
   exposing the credentials (in the URI or elsewhere).  If third-party
   scripts are included, the client MUST ensure that its own scripts
   (used to extract and remove the credentials from the URI) will
   execute first.