Google Oauth-2.0 returns url with hash instead of question mark

Question

I using this form to request Google Offline Token

    <form action="https://accounts.google.com/o/oauth2/auth" methode="POST">

        <input type="hidden" name="access_type" value="offline" />
        <input type="hidden" name="client_id" value="XXX" />
        <input type="hidden" name="scope" value="https://www.googleapis.com/auth/analytics https://www.googleapis.com/auth/analytics.edit https://www.googleapis.com/auth/analytics.manage.users https://www.googleapis.com/auth/analytics.manage.users.readonly https://www.googleapis.com/auth/analytics.readonly" />
        <input type="hidden" name="response_type" value="code token gsession" />
        <input type="hidden" name="redirect_uri" value="http://example.com/analytics" />
        <input type="hidden" name="approval_prompt" value="force" />

        <button>Get or Refresh token</button>

    </form>

How come Google sends me back an URL like :

http://example.com/analytics#access_token=XXX&token_type=Bearer&expires_in=3600&code=YYY&authuser=0&num_sessions=1&prompt=consent&session_state=ZZZ

Please notice we have an hash code # instead of a question mark ? after main url part.

I was expecting to get above variables with PHP $_GET but I can't because that hash code.

My question is how can I get an url with question mark instead ?

Answer 1

You're using a response_type of code token gsession that triggers a so-called Implicit flow in which the access_token will be returned in the URL fragment. Use response_type=code to get a code value as a query parameter that you can use at the token endpoint to exchange it for an access_token as described in: https://developers.google.com/accounts/docs/OAuth2WebServer#handlingtheresponse