// Extract the value of the 'redirect_uri' parameter from
// the authorization request.
redirectUri = ...
// Remember whether a redirect URI was explicitly given.
// It must be checked later in the implementation of the
// token endpoint because RFC 6749 states as follows.
//
// redirect_uri
// REQUIRED, if the "redirect_uri" parameter was
// included in the authorization request as described
// in Section 4.1.1, and their values MUST be identical.
//
explicit = (redirectUri != null);
// Extract registered redirect URIs from the database.
registeredRedirectUris = ...
// Requirements by RFC 6749 (OAuth 2.0) and those by
// OpenID Connect are different. Therefore, the code flow
// branches according to whether the request is an OpenID
// Connect request or not. This is judged by whether the
// 'scope' request parameter contains 'openid' as a value.
if ( 'openid' is included in 'scope' )
{
 // Check requirements by OpenID Connect.
 // If the 'redirect_uri' is not contained in the request.
 if ( redirectUri == null )
 {
 // The 'redirect_uri' parameter is mandatory in
 // OpenID Connect. It's optional in RFC 6749.
 throw new Exception(
 "The 'redirect_uri' parameter is missing.");
 }
 // For each registered redirect URI.
 for ( registeredRedirectUri : registeredRedirectUris )
 {
 // 'Simple String Comparison' is required by the
 // specification.
 if ( registeredRedirectUri.equals( redirectUri ) )
 {
 // OK. The redirect URI specified by the
 // authorization request is registered.
 registered = true;
 break;
 }
 }
 // If the redirect URI specified by the authorization
 // request matches none of the registered redirect URIs.
 if ( registered == false )
 {
 throw new Exception(
 "The redirect URI is not registered.");
 }
}
else
{
 // Check requirements by RFC 6749.
 // If redirect URIs are not registered at all.
 if ( registeredRedirectUris.size() == 0 )
 {
 // RFC 6749, 3.1.2.2. Registration Requirements says
 // as follows:
 //
 // The authorization server MUST require the
 // following clients to register their
 // redirection endpoint:
 //
 // o Public clients.
 // o Confidential clients utilizing the
 // implicit grant type.
 // If the type of the client application which made
 // the authorization request is 'public'.
 if ( client.getClientType() == PUBLIC )
 {
 throw new Exception(
 "A redirect URI must be registered.");
 }
 // If the client type is 'confidential' and if the
 // authorization flow is 'Implicit Flow'. If the
 // 'response_type' request parameter contains either
 // or both of 'token' and 'id_token', the flow should
 // be treated as a kind of 'Implicit Flow'.
 else if ( responseType.requiresImplicitFlow() )
 {
 throw new Exception(
 "A redirect URI must be registered.");
 }
 }
 // If the authorization request does not contain the
 // 'redirect_uri' request parameter.
 if ( redirectUri == null )
 {
 // If redirect URIs are not registered at all,
 // or if multiple redirect URIs are registered.
 if ( registeredRedirectUris.size() != 1 )
 {
 // A redirect URI must be explicitly specified
 // by the 'redirect_uri' parameter.
 throw new Exception(
 "The 'redirect_uri' parameter is missing.");
 }
 // One redirect URI is registered. Use it as the
 // default value of redirect URI.
 redirectUri = registeredRedirectUris[0];
 }
 // The authorization request contains the 'redirect_uri'
 // parameter, but redirect URIs are not registered.
 else if ( registeredRedirectUris.size() == 0 )
 {
 // The code flow reaches here if and only if the
 // client type is 'confidential' and the authorization
 // flow is not 'Implicit Flow'. In this case, the
 // redirect URI specified by the 'redirect_uri'
 // parameter of the authorization request is used
 // although it is not registered. However,
 // requirements written in RFC 6749, 3.1.2.
 // Redirection Endpoint are checked.
 // If the specified redirect URI is not an absolute one.
 if ( redirectUri.isAbsolute() == false )
 {
 throw new Exception(
 "The 'redirect_uri' is not an absolute URI.");
 }
 // If the specified redirect URI has a fragment part.
 if ( redirectUri.getFragment() != null )
 {
 throw new Exception(
 "The 'redirect_uri' has a fragment part.");
 }
 }
 else
 {
 // If the specified redirect URI is not an absolute one.
 if ( redirectUri.isAbsolute() == false )
 {
 throw new Exception(
 "The 'redirect_uri' is not an absolute URI.");
 }
 // If the specified redirect URI has a fragment part.
 if ( redirectUri.getFragment() != null )
 {
 throw new Exception(
 "The 'redirect_uri' has a fragment part.");
 }
 // For each registered redirect URI.
 for (registeredRedirectUri : registeredRedirectUris )
 {
 // If the registered redirect URI is a full URI.
 if ( registeredRedirectUri.getQuery() != null )
 {
 // 'Simple String Comparison'
 if ( registeredRedirectUri.equals( redirectUri ) )
 {
 // The specified redirect URI is registered.
 registered = true;
 break;
 }
 // This registered redirect URI does not match.
 continue;
 }
 // Compare the scheme parts.
 if ( registeredRedirectUri.getScheme().equals(
 redirectUri.getScheme() ) == false )
 {
 // This registered redirect URI does not match.
 continue;
 }
 // Compare the user information parts. Here I use
 // an imaginary method 'equalsSafely()' because
 // the code would become too long if I inlined it.
 // The method compares arguments without throwing
 // any exception even if either or both of the
 // arguments are null.
 if ( equalsSafely(
 registeredRedirectUri.getUserInfo(),
 redirectUri.getUserInfo() ) == false )
 {
 // This registered redirect URI does not match.
 continue;
 }
 // Compare the host parts. Ignore case sensitivity.
 if ( registeredRedirectUri.getHost().equalsIgnoreCase(
 redirectUri.getHost() ) == false )
 {
 // This registered redirect URI does not match.
 continue;
 }
 // Compare the port parts. Here I use an imaginary
 // method 'getPortOrDefaultPort()' because the
 // code would become too long if I inlined it. The
 // method returns the default port number of the
 // scheme when 'getPort()' returns -1. The last
 // resort is 'URI.toURL().getDefaultPort()'. -1 is
 // returned If 'getDefaultPort()' throws an exception.
 if ( getPortOrDefaultPort( registeredRedirectUri ) !=
 getPortOrDefaultPort( redirectUri ) )
 {
 // This registered redirect URI does not match.
 continue;
 }
 // Compare the path parts. Here I use the imaginary
 // method 'equalsSafely()' again.
 if ( equalsSafely( registeredRedirectUri.getPath(),
 redirectUri.getPath() ) == false )
 {
 // This registered redirect URI does not match.
 continue;
 }
 // The specified redirect URI is registered.
 registered = true;
 break;
 }
 // If none of the registered redirect URI matches.
 if ( registered == false )
 {
 throw new Exception(
 "The redirect URI is not registered.");
 }
 }
}
// Check requirements by the 'application_type' of the client.// If the value of the 'application_type' attribute is 'web'.
if ( client.getApplicationType() == WEB )
{
 // If the authorization flow is 'Implicit Flow'. When the
 // 'response_type' request parameter of the authorization
 // request contains either or both of 'token' and 'id_token',
 // it should be treated as a kind of 'Implicit Flow'.
 if ( responseType.requiresImplicitFlow() )
 {
 // If the scheme of the redirect URI is not 'https'.
 if ( "https".equals( redirectUri.getScheme() ) == false )
 {
 // The scheme part of the redirect URI must be
 // 'https' when a client application whose
 // 'application_type' is 'web' uses 'Implicit Flow'.
 throw new Exception(
 "The scheme of the redirect URI is not 'https'.");
 }
 // If the host of the redirect URI is 'localhost'.
 if ( "localhost".equals( redirectUri.getHost() ) )
 {
 // The host of the redirect URI must not be
 // 'localhost' when a client application whose
 // 'application_type' is 'web' uses 'Implicit Flow'.
 throw new Exception(
 "The host of the redirect URI is 'localhost'.");
 }
 }
}
// If the value of the 'application_type' attribute is 'native'.
else if ( client.getApplicationType() == NATIVE )
{
 // If the scheme of the redirect URI is 'https'.
 if ( "https".equals( redirectUri.getScheme() ) )
 {
 // The scheme of the redirect URI must not be 'https'
 // when the 'application_type' of the client is 'native'.
 throw new Exception(
 "The scheme of the redirect URI is 'https'.");
 }
 // If the scheme of the redirect URI is 'http'.
 if ( "http".equals( redirectUri.getScheme() ) )
 {
 // If the host of the redirect URI is not 'localhost'.
 if ( "localhost".equals(
 redirectUri.getHost() ) == false )
 {
 // When a client application whose 'application_type'
 // is 'native' uses a redirect URI whose scheme is
 // 'http', the host port of the URI must be
 // 'localhost'.
 throw new Exception(
 "The host of the redirect URI is not 'localhost'.");
 }
 }
}
// If the value of the 'application_type' attribute is neither
// 'web' or 'native'.
else
{
 // As mentioned above, Authlete allows 'unspecified' as a
 // value of the 'application_type' attribute. Therefore,
 // no exception is thrown here.
}