一个对我有用的解决方法(使用Backbone.js)是在传递给Facebook的重定向URL的末尾添加“#/”。Facebook将保留提供的片段，而不会附加自己的“_=_”。

返回时，Backbone将删除“#/”部分。对于AngularJS，在返回URL后附加“#!”应该可以工作。

注意，大多数浏览器在重定向(通过HTTP状态码300、301、302和303)时保留原始URL的片段标识符，除非重定向URL也有片段标识符。这似乎是被推荐的行为。

如果使用处理程序脚本将用户重定向到其他地方，则可以在此处的重定向URL后附加“#”，以将片段标识符替换为空字符串。

这是Facebook出于安全考虑而设计的。下面是Facebook团队成员埃里克·奥斯古德的解释:

This has been marked as 'by design' because it prevents a potential security vulnerability. Some browsers will append the hash fragment from a URL to the end of a new URL to which they have been redirected (if that new URL does not itself have a hash fragment). For example if example1.com returns a redirect to example2.com, then a browser going to example1.com#abc will go to example2.com#abc, and the hash fragment content from example1.com would be accessible to a script on example2.com. Since it is possible to have one auth flow redirect to another, it would be possible to have sensitive auth data from one app accessible to another. This is mitigated by appending a new hash fragment to the redirect URL to prevent this browser behavior. If the aesthetics, or client-side behavior, of the resulting URL are of concern, it would be possible to use window.location.hash (or even a server-side redirect of your own) to remove the offending characters.

来源:https://developers.facebook.com/bugs/318390728250352/

对我来说，我让JavaScript重定向到另一个页面，以摆脱#_=_。下面的想法应该有用。：）

function redirect($url){
    echo "<script>window.location.href='{$url}?{$_SERVER["QUERY_STRING"]}'</script>";        
}

如果你使用vue-router，你可以添加到路由列表:

{
  path: '/_=_',
  redirect: '/', // <-- or other default route
},

不知道他们为什么这样做，但是，你可以通过重置页面顶部的哈希来解决这个问题:

if (window.location.hash == "#_=_")
  window.location.hash = "";

删除“#_=_”(PHP)的最简单和干净的解决方案:

用“echo(”Location .php)代替“header("Location: xxx.php");"Href = 'xxx.php';");"