Probably you mean the FB API that doesn't restrict the redirect URL by default.

Google(+?) requires you to whitelist possible redirect URLs, meaning that it's much more obvious what happens after a redirect. Thus limiting what an attacker may do...