3.3.1. 非文本 Verification URI 优化 (Non-Textual Verification URI Optimization)

当 authorization response (Section 3.2) 中包含 verification_uri_complete 时, client MAY 使用任何会让 browser 打开该 URI 的方法, 以 non-textual 方式呈现此 URI, 例如 QR (Quick Response) code 或 NFC (Near Field Communication), 以免 user 手动键入 URI.

出于 usability 原因, RECOMMENDED client 仍为无法使用此类 shortcut 的 user 显示文本 verification URI (verification_uri). client MUST 仍显示 user_code, 因为 authorization server 会要求 user 确认它, 用于区分 device 或作为 remote phishing mitigation (见 Section 5.4).

如果 user 通过导航到 verification_uri_complete 开始 user interaction, 则仍遵循 Section 3.3 描述的 user interaction, 但优化之处在于 user 不需要键入 user_code. server SHOULD 向 user 显示 user_code, 并要求其验证该 code 与 device 上显示的 user_code 匹配, 以确认其正在授权正确的 device. 与之前一样, 除了采取步骤确认 device identity 之外, user 也应获得 approve 或 deny authorization request 的选择.

+-------------------------------------------------+
|                                                 |
|  Scan the QR code or, using     +------------+ |
|  a browser on another device,   |[_]..  . [_]| |
|  visit:                         | .  ..   . .| |
|  https://example.com/device     | . .  . ....| |
|                                 |.   . . .   | |
|  And enter the code:            |[_]. ... .  | |
|  WDJB-MJHT                      +------------+ |
|                                                 |
+-------------------------------------------------+

Figure 3: Example User Instruction with QR Code Representation
                of the Complete Verification URI