I am trying to use javascript to login to identity server in OAuths Client. I can login and return to the return webpage successful. I met a problem is why the Thinktecture identity sevrer always return '#' not '?' before parameters in querystring ,is that a bug?
the other question is how can I get the uses claims when I have access_token?
Implicit flow uses a hash fragment not a query string - that is not a bug (check the OAuth2 spec).
The client does not consume the access token in OAuth2 - it is opaque to the client - the access token is meant to be used by the backend.