code: private static void federatedFlowStep2(
        LoginInput loginInput,
        String tokenUrl,
        String ssoUrl) throws SnowflakeSQLException
    {
      try
      {
        if (!isPrefixEqual(loginInput.getAuthenticator(), tokenUrl) ||
            !isPrefixEqual(loginInput.getAuthenticator(), ssoUrl))
        {
          logger.debug("The specified authenticator {} is not supported.",
                       loginInput.getAuthenticator());
          throw new SnowflakeSQLException(
              SqlState.SQLCLIENT_UNABLE_TO_ESTABLISH_SQLCONNECTION,
              ErrorCode.IDP_CONNECTION_ERROR.getMessageCode());
        }
      }
      catch (MalformedURLException ex)
      {
        handleFederatedFlowError(loginInput, ex);
      }
    }
docs: Perform important client side validation:
  validate both token url and sso url contains same prefix
  (protocol + host + port) as the given authenticator url.
  Explanation:
  This provides a way for the user to 'authenticate' the IDP it is
  sending his/her credentials to.  Without such a check, the user could
  be coerced to provide credentials to an IDP impersonator.
  
  @param loginInput
  @param tokenUrl
  @param ssoUrl
  @throws SnowflakeSQLException