cloudron-box/dashboard/authcallback.html

<script>

var tmp = window.location.hash.slice(1).split('&');

// FIXME: implicit flow (response_type=code token) results in access_token query param. this is not secure
tmp.forEach(function (pair) {
    if (pair.indexOf('access_token=') === 0) localStorage.token = pair.split('=')[1];
});

var redirectTo = '/';
if (localStorage.getItem('redirectToHash')) {
    redirectTo += localStorage.getItem('redirectToHash');
    localStorage.removeItem('redirectToHash');
}
window.location.href = redirectTo;

</script>