The video from Okta says that it's possible to hijack the access token when on public wifi. But if HTTPS is used, the headers are encrypted. And therefore the
Location returned by the Auth Server won't be visible to the attacker.
Replay attacks won't help the attackers either - again because the headers are encrypted.
So are there actually any ways that MITM or anyone else can intercept the token in the URL? It seems like this flow is more secure than people say..