use the implicit grant or other response types that issue access tokens in the authorization response.

Condition: unless access-token injection is prevented and the identified token-leakage vectors are mitigated

clients SHOULD NOT use the implicit grant (response type token) or other response types issuing access tokens in the authorization response

use the `code` response type or another response type that issues access tokens in the token response.

Condition: instead of the implicit grant or other response types issuing access tokens in the authorization response

Clients SHOULD instead use the response type code

implement and use client metadata fields.

Condition: unless a field definition states otherwise

The implementation and use of all client metadata fields is OPTIONAL, unless stated otherwise.

implement support for the `redirect_uris` metadata value.

Condition: when supporting dynamic registration for redirect-based flows

MUST implement support for this metadata value

use exact string matching when comparing client redirection URIs against pre-registered URIs.

Condition: except for port numbers in native application localhost redirection URIs

authorization servers MUST utilize exact string matching except for port numbers in localhost redirection URIs of native apps

expose URLs that forward the user's browser to arbitrary URIs obtained from a query parameter.

Clients and authorization servers MUST NOT expose URLs that forward the user's browser to arbitrary URIs obtained from a query parameter

register their redirection URI values.

clients using flows with redirection MUST register their redirection URI values

ensure that the redirection URI used to obtain an authorization code is identical to the URI used when exchanging that code.

the authorization server MUST ensure that the redirection URI used to obtain the authorization code is identical to the redirection URI provided when exchanging the authorization code

require public clients to register their redirection URIs.

The authorization server MUST require public clients

validate a supplied redirection URI against the registered value.

Condition: if a redirection URI is provided in the request

the authorization server MUST validate it against the registered value

retain the registered endpoint URI query component when adding query parameters.

Condition: when the endpoint URI contains a query component

which MUST be retained when adding additional query parameters

require public clients and confidential clients using the implicit grant to register their redirection endpoint.

The authorization server MUST require the following clients to register their redirection endpoint

compare and match the received redirection URI against at least one registered redirection URI or registered URI component.

Condition: when `redirect_uri` is included and redirection URIs were registered

the authorization server MUST compare and match the value received against at least one of the registered redirection URIs (or URI components)

compare the two URIs using simple string comparison.

Condition: if the client registration included the full redirection URI

the authorization server MUST compare the two URIs using simple string comparison

ensure that the requested and registered redirection URIs are equal.

Condition: when validating redirection URIs, except for the native application localhost port exception

the authorization server MUST ensure that the two URIs are equal

allow variable port numbers.

Condition: for native applications using a localhost redirection URI

the authorization server MUST allow variable port numbers

require confidential clients to register their redirection URIs.

SHOULD require confidential clients to register their redirection URIs

require all clients to register their redirection endpoint before using the authorization endpoint.

The authorization server SHOULD require all clients to register their redirection endpoint prior to utilizing the authorization endpoint.

require the client to provide the complete redirection URI.

The authorization server SHOULD require the client to provide the complete redirection URI

require registration of the URI scheme, authority, and path.

Condition: if registration of the complete redirection URI is not possible

the authorization server SHOULD require the registration of the URI scheme, authority, and path

allow the client to register multiple redirection endpoints.

The authorization server MAY allow the client to register multiple redirection endpoints.

trust the redirection URI without further checks.

Condition: if the origin and integrity of the authorization request containing it can be verified

the authorization server MAY trust the redirection URI without further checks

include a redirection URI using the `redirect_uri` authorization request parameter.

Condition: if multiple redirection URIs, only URI components, or no redirection URI were registered

the client MUST include a redirection URI with the authorization request using the redirect_uri request parameter

include a fragment component.

The endpoint URI MUST NOT include a fragment component.

include an application/x-www-form-urlencoded query component.

The endpoint URI MAY include an application/x-www-form-urlencoded formatted query component

be an absolute URI.

The redirection endpoint URI MUST be an absolute URI

expose open redirectors.

Web servers on which redirection URIs are hosted MUST NOT expose open redirectors