I wasn't able to find a similar question explaining the considerations of the RFC6749 specification when it comes to redirecting the user from the authorization server to the client. In the RFC document, under 3.1.2, it states
The endpoint URI MUST NOT include a fragment component.
How come this is "MUST NOT"? Are there any security considerations here? I clearly do not want to redirect using simple query params for user-agent clients as they are available during transition. I've noticed OIDC implements this using hash fragments, but I'm wondering why OAuth 2.0 discourage this? Any takes?
If the question has been answered previously I appreciate help with linking to the question.
I'm wondering If I have misunderstood the phrasing used, could the endpoint URI point to the URI BEFORE appending access_tokens? aka. the endpoint URI's registered for the client, "redirect_uri" and not the actual redirected URI. I assume this because one wouldn't want two fragments in the redirected URI.