From 4516214aebb65bde26c7d53c8801583d7a5af594 Mon Sep 17 00:00:00 2001
From: Andrei L <1881266+unrevised6419@users.noreply.github.com>
Date: Tue, 3 Feb 2026 18:17:41 +0200
Subject: [PATCH] fix(response): allow callback with query string

Closes #317
---
 lib/response.js  |  2 +-
 test/response.js | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/lib/response.js b/lib/response.js
index e67a0135..eee224d6 100644
--- a/lib/response.js
+++ b/lib/response.js
@@ -105,7 +105,7 @@ var transport = ({provider, input, input:{params, state, session}, output}) => (
     ? output
 
     : (!provider.transport || provider.transport === 'querystring')
-    ? `${provider.callback || '/'}?${qs.stringify(output)}`
+    ? `${provider.callback || '/'}${(provider.callback || '').includes('?') ? '&' : '?'}${qs.stringify(output)}`
 
     : provider.transport === 'session'
     ? provider.callback
diff --git a/test/response.js b/test/response.js
index a8cb40a6..5a38cb29 100644
--- a/test/response.js
+++ b/test/response.js
@@ -154,4 +154,18 @@ describe('response', () => {
     })
   })
 
+  describe('transport', () => {
+
+    it('callback with existing query string', () => {
+      var provider = {callback: 'https://example.com/callback?foo=bar', transport: 'querystring'}
+      var input = {params: {override: 'callback'}, state: {}, session: {}}
+      var output = {access_token: 'token'}
+      t.equal(
+        response.transport({provider, input, output}).location,
+        'https://example.com/callback?foo=bar&access_token=token'
+      )
+    })
+
+  })
+
 })