title: OAuth2.0 Implicit Grant flow. Why use url hash fragments?
body: <p>Going through the new OAuth2.0 Specs ( rfc 6749 ), I see that Implicit Grant protocol workflow uses Url Hash Fragments to exchange the 'access_token' between the Authorisation server and the public client.</p>
  <p>See Specs: <a href="https://www.rfc-editor.org/rfc/rfc6749#section-4.2" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc6749#section-4.2</a></p>
  <p>Cannot the Authorisation grant response be send as 'Query Params' instead of the Url fragment, keeping other parts of the flow as it is ?</p>
  <p>Basically I cannot understand the limitation that made spec authors of OAuth2 chose url hash fragments for Implicit grant flow authorisation ?</p>