OAuth2ValidatorImpl implements OAuth2Validator { protected String determineRedirectUri(AuthorizationRequest authorizationRequest, String responseType, Client client) { List<String> uris = client.getRedirectUris(); String redirectUri = authorizationRequest.getRedirectUri(); if (StringUtils.isBlank(redirectUri)) { if (responseType.equals(IMPLICIT_GRANT_RESPONSE_TYPE)) { throw new ValidationResponseException(IMPLICIT_GRANT_REDIRECT_URI); } else if (CollectionUtils.isEmpty(uris)) { throw new ValidationResponseException(REDIRECT_URI_REQUIRED); } else { return uris.get(0); } } else if (!AuthenticationFilter.isValidUri(redirectUri)) { throw new ValidationResponseException(REDIRECT_URI_NOT_URI); } else if (redirectUri.contains("#")) { throw new ValidationResponseException(REDIRECT_URI_FRAGMENT_COMPONENT); } else if (CollectionUtils.isNotEmpty(uris)) { boolean match = false; for (String uri : uris) { if (redirectUri.startsWith(uri)) { match = true; break; } } if (!match) { authorizationRequest.setRedirectUri(uris.get(0)); throw new ValidationResponseException(REDIRECT_URI_NOT_VALID); } } return redirectUri; }  @Override ValidationResponse validate(AuthorizationRequest authorizationRequest); @Override ValidationResponse validate(AccessTokenRequest request, 
      BasicAuthCredentials clientCredentials);  }
@Test public void determineRedirectUri() { request.setRedirectUri("http: validator.determineRedirectUri(request, "code", createClient("clientId")); validate(ValidationResponse.VALID); }
@Test public void implicitGrantNoRedirectGivenShouldUseDefault() { Client client = createClient("any"); final String uri = "http: request.setRedirectUri(""); client.setRedirectUris(Arrays.asList(uri)); try { final String determinedUri = validator.determineRedirectUri(request, OAuth2ValidatorImpl.IMPLICIT_GRANT_RESPONSE_TYPE, client); fail(); } catch (ValidationResponseException e) { assertEquals(ValidationResponse.IMPLICIT_GRANT_REDIRECT_URI, e.v); } }
@Test public void determineUrlValidImplicitGrant() { Client client = createClient("any"); final String uri = "http: request.setRedirectUri(uri); client.setRedirectUris(Arrays.asList(uri)); final String determinedUri = validator.determineRedirectUri(request, OAuth2ValidatorImpl.IMPLICIT_GRANT_RESPONSE_TYPE, client); assertEquals(uri, determinedUri); }