This would possibly cause security concerns as it doesn’t follow the recommendations in section 10.2 of the OAuth 2 spec.