I don't think that's a bug, for implicit OAuth. Anyway, if I understand RFC 6749 correctly, that is not how you are supposed to do such extra checks.

Use the state parameter. And this works.

For example, a call to:
  /oauth/dialog?...&state=robfoo&redirect_uri=https://stackexchange.com/oauth/login_success
(Click the link and try it.)

Yields results like:   `https://stackexchange.com/oauth/login_success#access_token=Qs...LUg))&state=robfoo`

When the user authorizes the app.

I don't think that's a bug, for implicit OAuth. Anyway, if I understand RFC 6749 correctly, that is not how you are supposed to do such extra checks.

Use the state parameter. And this works.

For example, a call to:
  /oauth/dialog?...&state=robfoo&redirect_uri=https://stackexchange.com/oauth/login_success
(Click the link and try it.)

Yields results like:   `https://stackexchange.com/oauth/login_success#access_token=Qs...LUg))&state=robfoo`

When the user authorizes the app.

I don't think that's technically a bug. Anyway, if I understand RFC 6749 correctly, that is not how you are supposed to do such extra checks.

Use the state parameter. And this works.

For example, a call to:
  /oauth/dialog?...&state=robfoo&redirect_uri=https://stackexchange.com/oauth/login_success
(Click the link and try it.)

Yields results like:   `https://stackexchange.com/oauth/login_success#access_token=Qs...LUg))&state=robfoo`

When the user authorizes the app.

I don't think that's a bug, for implicit OAuth. Anyway, if I understand RFC 6749 correctly, that is not how you are supposed to do such extra checks.

Use the state parameter. And this works.

For example, a call to:
  /oauth/dialog?...&state=robfoo&redirect_uri=https://stackexchange.com/oauth/login_success
(Click the link and try it.)

Yields results like:   `https://stackexchange.com/oauth/login_success#access_token=Qs...LUg))&state=robfoo`

When the user authorizes the app.