We implemented this feature based on the standard RFC specification. The issue you encountered is very likely due to the browser's security settings being too high, which can cause abnormal behavior under higher security levels. You may try switching to a different browser.
By the way, we use a cross-domain cookie mechanism to authorize the VS Code server, which works under standard browser security levels. If your browser imposes any restrictions on cross-domain cookies, it may lead to authorization failures.