Solutionunvalidated
you could use JavaScript to obtain the `hash` property of the `Location` interface, i.e., `window.location.hash` — Since the "fragment" is only available/accessible on client side. Tension: To do that, you could have a `/callback_init` endpoint that is initially called and used as the `redirect_uri` for the authorization server. Outcome: and which will return the relevant JavaScript code to read the fragment and pass it in the query string of the URL to the final `/callback` endpoint.
d4499015-4ba8-426f-80d5-1270c2020b82
you could use JavaScript to obtain the hash property of the Location interface, i.e., window.location.hash — Since the "fragment" is only available/accessible on client side. Tension: To do that, you could have a /callback_init endpoint that is initially called and used as the redirect_uri for the authorization server. Outcome: and which will return the relevant JavaScript code to read the fragment and pass it in the query string of the URL to the final /callback endpoint.