title: Weird url appended "#_=_"
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/7324944/play-framework-appending-to-redirect-after-facebook-auth-via-oauth2">Play Framework appending #<em>=</em> to redirect after Facebook auth via OAuth2?</a>  </p>
  </blockquote>
  
  
  
  <p>Has anyone else seen this happen?</p>
  
  <p>I am building a Facebook canvas app using the Facebook PHP SDK, and some Javascript.<br/>
  Now when I take the user through the OAuth authentication flow, I have noticed that the URL in the  browser automatically gets appended with this <code>"#_=_"</code> , so my URL starts looking like this:</p>
  
  <pre><code>http://apps.facebook.com/xxxxxxxxxxxx/#_=_
  </code></pre>
  
  <p>and when I redirect to the app profile page the URL is this:</p>
  
  <pre><code>http://www.facebook.com/apps/application.php?id=xxxxxxxxxxxx#_=_
  </code></pre>
  
  <p>I am redirecting using</p>
  
  <pre><code>echo "&lt;script type='text/javascript'&gt;top.location.href='$appcanvasurl';&lt;/script&gt;"
  </code></pre>
  
  <p>to the canvas URL, and</p>
  
  <pre><code>echo "&lt;script type='text/javascript'&gt;top.location.href='$appprofurl';&lt;/script&gt;"
  </code></pre>
  
  <p>for app profile page.</p>
  
  <p>So why is this <code>#_=_</code> getting appended?</p>
  
  <p><strong>Update:</strong></p>
  
  <p>According to <a href="https://developers.facebook.com/bugs/318390728250352?browse=search_507eb75370b6e0154879360" rel="noreferrer" title="https://developers.facebook.com/bugs/318390728250352?browse=search_507eb75370b6e0154879360">this bug on the tracker</a>, this is by design, and giving a value for the <code>redirect_uri</code> does not change this.</p>
  
  <p>And according to the <a href="https://developers.facebook.com/bugs/318390728250352?fb_comment_id=fbc_10151751027806988_358309612_10151883481651988" rel="noreferrer" title="https://developers.facebook.com/bugs/318390728250352?fb_comment_id=fbc_10151751027806988_358309612_10151883481651988">official facebook reply on that page</a> (have to be logged in to Facebook to view the post):</p>
  
  <blockquote>
    <blockquote>
      <p>This has been marked as 'by design' because it prevents a potential security vulnerability.</p>
      
      <p>Some browsers will append the hash fragment from a URL to the end of a new URL to which they have been redirected (if that new URL does not itself have a hash fragment).</p>
      
      <p>For example if example1.com returns a redirect to example2.com, then a browser going to example1.com#abc will go to example2.com#abc, and the hash fragment content from example1.com would be accessible to a script on example2.com.</p>
      
      <p>Since it is possible to have one auth flow redirect to another, it would be possible to have sensitive auth data from one app accessible to another.</p>
      
      <p>This is mitigated by appending a new hash fragment to the redirect URL to prevent this browser behavior.</p>
      
      <p>If the aesthetics, or client-side behavior, of the resulting URL are of concern, it would be possible to use window.location.hash (or even a server-side redirect of your own) to remove the offending characters.</p>
    </blockquote>
  </blockquote>