Probably you mean the FB API that doesn't restrict the redirect URL by default. Google(+?) requires you to whitelist possible redirect URLs, meaning that it's

Probably you mean the FB API that doesn't restrict the redirect URL by default. Google(+?) requires you to whitelist possible redirect URLs, meaning that it's much more obvious what happens after a redirect. Thus limiting what an attacker may do...