fix: correctly handle ? and & in location replacements

Author: kranich

projects/lib/src/oauth-service.ts

@@ -1630,10 +1630,13 @@ export class OAuthService extends AuthConfig implements OnDestroy {
 
     if (!options.preventClearHashAfterLogin) {
       const href = location.origin + location.pathname +
-        location.search.replace(/[&\?]code=[^&\$]*/, '')
-        .replace(/[&\?]scope=[^&\$]*/, '')
-        .replace(/[&\?]state=[^&\$]*/, '')
-        .replace(/[&\?]session_state=[^&\$]*/, '') + location.hash;
+        location.search.replace(/code=[^&\$]*/, '')
+        .replace(/scope=[^&\$]*/, '')
+        .replace(/state=[^&\$]*/, '')
+        .replace(/session_state=[^&\$]*/, '')
+        .replace(/^\?&/, '?')
+        .replace(/&$/, '')
+        .replace(/^\?$/, '') + location.hash;
 
       history.replaceState(null, window.name, href);
     }