protected List<String> getAuthorizeUrls() {
        return CollectionUtils.wrapList(OAuth20Constants.AUTHORIZE_URL);
    }
Is the client requesting is a OAuth "public" client?
An OAuth "public" client is one that does not define a secret like a mobile application.

@param request  the request
@param response the response
@return true/false
support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/OAuth20HandlerInterceptorAdapter.java