We're having a very strange issue all of a sudden with Google's OAuth protocol. For the past 2 months, we have had working code here, and all of a sudden requests exchanging the authorization code for the access and refresh tokens are failing.
I noticed that on the response for the authorization code, there's an extra # appended to the URL as below:
http://localhost/?code=[AUTHORIZATION CODE]#
Pulling the parameter out results in [AUTHORIZATION CODE]# as the code, and passing this in to the token request endpoint causes a failure.
Removing the # from this string fixes the issue. Did Google change something today? I also noticed that there has supposedly been a spike in login outages since this morning on other sites like this. Any insights would be very helpful.
