title: Javascript access to Location header's URL fragment for OAuth 2
body: <p>The OAuth 2.0 implicit grant (http://tools.ietf.org/html/draft-ietf-oauth-v2-31#section-4.2) involves some interesting choreography between the client application, the browser and the authorization server.  The auth server returns an HTTP 302 status code to the browser with a Location header like so: </p>
  
  <p>Location:&nbsp;http://clientapp.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA&amp;state=xyz&amp;token_type=example&amp;expires_in=3600</p>
  
  <p>The browser drops the fragment before it executes the redirection, and the service at clientapp.com/cb should respond with [from the spec] "a web page (typically an HTML document with an embedded script) capable of accessing the full redirection URI including the fragment retained by the user-agent, and extracting the access token (and other parameters) contained in the fragment".  </p>
  
  <p>I've implemented the authorization server portion of this, but have very little JavaScript experience. How do you get JavaScript to access the fragment that the browser stripped off before the redirection?  </p>
  
  <p>Thanks,<br>
  Michael</p>