diff --git a/js/dist/forum.js b/js/dist/forum.js
index 4c8eaf1..5515709 100644
Binary files a/js/dist/forum.js and b/js/dist/forum.js differ
diff --git a/js/dist/forum.js.map b/js/dist/forum.js.map
index c314cbb..36873d7 100644
Binary files a/js/dist/forum.js.map and b/js/dist/forum.js.map differ
diff --git a/js/src/forum/components/oauth/AuthorizePage.js b/js/src/forum/components/oauth/AuthorizePage.js
index 6d31f91..522ba40 100644
--- a/js/src/forum/components/oauth/AuthorizePage.js
+++ b/js/src/forum/components/oauth/AuthorizePage.js
@@ -43,7 +43,7 @@ export default class AuthorizePage extends IndexPage {
           if (app.forum.attribute('foskym-oauth-center.require_exact_redirect_uri') && uris.indexOf(params.redirect_uri) == -1) {
             m.route.set('/');
           }
-          if (app.forum.attribute('foskym-oauth-center.allow_implicit') && params.response_type == 'token') {
+          if (!app.forum.attribute('foskym-oauth-center.allow_implicit') && params.response_type == 'token') {
             m.route.set('/');
           }
           if (app.forum.attribute('foskym-oauth-center.enforce_state') && params.enforce_state == null) {
@@ -214,12 +214,7 @@ export default class AuthorizePage extends IndexPage {
         is_authorized: this.is_authorized,
       }
     }).then((params) => {
-      let arr = []
-      for (let k in params) {
-        arr.push(`${k}=${params[k]}`)
-      }
-      let url = `${this.params.redirect_uri }?${arr.join('&')}`;
-      window.location.href = url;
+      window.location.href = params.location;
     });
 
     // Some form handling logic here
diff --git a/src/Controllers/AuthorizeController.php b/src/Controllers/AuthorizeController.php
index b004f71..7313f2a 100644
--- a/src/Controllers/AuthorizeController.php
+++ b/src/Controllers/AuthorizeController.php
@@ -47,9 +47,9 @@ class AuthorizeController implements RequestHandlerInterface
         $is_authorized = Arr::get($params, 'is_authorized', 0);
         $server->handleAuthorizeRequest($request, $response, $is_authorized, $actor->id);
         if ($is_authorized) {
-            $code = substr($response->getHttpHeader('Location'), strpos($response->getHttpHeader('Location'), 'code=') + 5, 40);
+//            $code = substr($response->getHttpHeader('Location'), strpos($response->getHttpHeader('Location'), 'code=') + 5, 40);
             return new JsonResponse([
-                'code'  =>  $code
+                'location'  =>  $response->getHttpHeader('Location')
             ]);
         }