cloudron-box/dashboard/authcallback.html

<script>

const tmp = window.location.hash.slice(1).split('&');

// FIXME: implicit flow (response_type=code token) results in access_token query param. this is not secure
tmp.forEach(function (pair) {
    if (pair.indexOf('access_token=') === 0) localStorage.token = pair.split('=')[1];
});

const redirectTo = '/';
if (localStorage.getItem('redirectToHash')) {
    redirectTo += localStorage.getItem('redirectToHash');
    localStorage.removeItem('redirectToHash');
}

window.location.replace(redirectTo); // this removes us from history

</script>