Question

login.php

<?php
    define('client_id', 'cid');
    define('redirect_uri', 'http://domain.tld/file.php');
    define('client_secret', 'secret');


    $endpoint = 'https://accounts.google.com/o/oauth2/auth';
    $querystr = array(
        'response_type' => 'token',
        'client_id' => client_id,
        'redirect_uri' => redirect_uri,
        'scope' => 'https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile',
#       'state' => $_SERVER['REQUEST_URI']
    );


    if (isset($_GET['access_token']))
        print_r($_GET);
    else
        header('Location: ' . $endpoint . '?' . http_build_query($querystr));

?>

The above code works fine, the problem I’m having is that the responce I’m getting from Google is not well formed. The query string that I’m getting from them does not start with a question mark ?, it starts with a number sign #. The following is an example returend from Google’s server.

http://domain.tld/file.php#access_token=ya29.AHES6ZABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmno&token_type=Bearer&expires_in=3600

Why is it separating the query string from the file path by a number sign? It it because I’m not using a https schema and it’s punishing me?

Answer 1

No. It’s called the “hash” of the URL. For responses from the server to the client (and not vice versa), this is a common scheme. Facebook OAuth 2.0 also uses this technique, for example. Just get used to it, and interpret the response beginning from the hash sign.