Essentially, if you're saying "I have OAuth 2.0, and I need authentication and . directly as a parameter in the URL hash) and don't properly use the OAuth state .