Allowing the query string to be altered is allowed but discouraged by the OAuth 2.0 spec: https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2....