In the OAuth2 Implict Grant flow, the access token is added to the URL fragment as part of the redirect from the Authorization Server to the Relying Party. Since this access token is made visible to the end-user in the Callback URL, this URL could be copied to a separate browser (or device), thereby allowing 2 independent browsers to use the same session.
For example, Medium's Facebook SSO login exposes the following Callback URL:
This URL could be copied to another browser to allow access to the user's account on another device as long as the access token has not expired.
This could lead to a circumstance where login sessions are not properly logged, as the 2 browsers would be sharing the same session. This may also not be ideal where preventing concurrent sessions is necessary.
However, this type of flow, and the inclusion of the access token in plaintext in the URL, appears to be the standard practice when Oauth2 is used (In fact, https://portswigger.net/web-security/oauth appears to take for granted that the access token would be thus exposed, and just tries to limit the damage if an attacker were to get hold of the access token before it expires, e.g., by limiting the scope, recommending use of HSTS to prevent MITM, etc.). So what would be the best way to detect "session sharing", so that the proper authentication policies can be applied?