Why, when I'm requesting
/oauth/dialog and selecting either of the options I get redirected to the same URL with different hash values? It's not a bug per-se, just an observation I made while developing an app.
This is just how OAuth 2.0 indicates rejection, you get different values on the redirect (either in the hash for the implicit client side flow, or in proper query string parameters for the explicit server side flow).
access_token (depending on the flow the app is using) you get
error_description. When a user rejects you get