@@ -205,7 +205,7 @@ A successful oAuth flow will redirect to the origin or redirect URL in the form
 
 <BlockQuote type="info" label="Note">
 
-The redirect is using a hash instead of a query string by default because it is not logged server side and can be easily read on the client. You can force query based redirect by adding a `?` to the end of the `redirect` option.
+The redirect is using a hash instead of a query string by default because it is not logged server side and can be easily read on the client. You can force query based redirect by adding a `?` to the end of the `redirect` option. This only applies to the configured option, a `redirect` query parameter always gets the hash.
 
 </BlockQuote>
 
 
@@ -237,7 +237,8 @@ export class OAuthStrategy extends AuthenticationBaseStrategy {
     }
 
     const redirectUrl = `${redirect}${queryRedirect}`
-    const separator = redirectUrl.endsWith('?') ? '' : redirect.indexOf('#') !== -1 ? '?' : '#'
+    // Only the configured redirect can put the token in the query string, a client supplied redirect can not
+    const separator = redirect.endsWith('?') && !queryRedirect ? '' : redirect.indexOf('#') !== -1 ? '?' : '#'
     const authResult: AuthenticationResult = data
     const query = authResult.accessToken
       ? { access_token: authResult.accessToken }
 
@@ -446,7 +446,13 @@ describe('@feathersjs/authentication-oauth/strategy', () => {
         redirect: '/hi-there?'
       }
     )
-    assert.equal(redirect, '/home/hi-there?access_token=testing')
+    assert.equal(redirect, '/home/hi-there?#access_token=testing')
+
+    redirect = await strategy.getRedirect({ accessToken: 'testing' }, { redirect: '?' })
+    assert.equal(redirect, '/home?#access_token=testing')
+
+    redirect = await strategy.getRedirect(new Error('something went wrong'), { redirect: '/hi-there?' })
+    assert.equal(redirect, '/home/hi-there?#error=something%20went%20wrong')
 
     redirect = await strategy.getRedirect(new Error('something went wrong'))
     assert.equal(redirect, '/home#error=something%20went%20wrong')
@@ -459,6 +465,9 @@ describe('@feathersjs/authentication-oauth/strategy', () => {
     redirect = await strategy.getRedirect({ accessToken: 'testing' })
     assert.equal(redirect, '/home?access_token=testing')
 
+    redirect = await strategy.getRedirect({ accessToken: 'testing' }, { redirect: '/hi-there' })
+    assert.equal(redirect, '/home?/hi-there#access_token=testing')
+
     delete app.get('authentication').oauth.redirect
 
     redirect = await strategy.getRedirect({ accessToken: 'testing' })
@@ -507,6 +516,17 @@ describe('@feathersjs/authentication-oauth/strategy', () => {
     )
     assert.equal(redirect, 'https://feathersjs.com/home#access_token=testing')
 
+    redirect = await strategy.getRedirect(
+      { accessToken: 'testing' },
+      {
+        redirect: '/home?',
+        headers: {
+          referer: 'https://feathersjs.com/somewhere'
+        }
+      }
+    )
+    assert.equal(redirect, 'https://feathersjs.com/home?#access_token=testing')
+
     await assert.rejects(
       () =>
         strategy.getRedirect(
Original file line number	Diff line number	Diff line change
`@@ -237,7 +237,8 @@ export class OAuthStrategy extends AuthenticationBaseStrategy {`
`237`	`237`	`}`
`238`	`238`
`239`	`239`	const redirectUrl = `${redirect}${queryRedirect}`
`240`		`- const separator = redirectUrl.endsWith('?') ? '' : redirect.indexOf('#') !== -1 ? '?' : '#'`
	`240`	`+ // Only the configured redirect can put the token in the query string, a client supplied redirect can not`
	`241`	`+ const separator = redirect.endsWith('?') && !queryRedirect ? '' : redirect.indexOf('#') !== -1 ? '?' : '#'`
`241`	`242`	`const authResult: AuthenticationResult = data`
`242`	`243`	`const query = authResult.accessToken`
`243`	`244`	`? { access_token: authResult.accessToken }`