Facebook回调已经开始追加#_=_哈希下划线返回URL
有人知道为什么吗?解决方案是什么?
当前回答
博士TL;
if (window.location.hash === "#_=_"){
history.replaceState
? history.replaceState(null, null, window.location.href.split("#")[0])
: window.location.hash = "";
}
完整版本与一步一步的说明
// Test for the ugliness.
if (window.location.hash === "#_=_"){
// Check if the browser supports history.replaceState.
if (history.replaceState) {
// Keep the exact URL up to the hash.
var cleanHref = window.location.href.split("#")[0];
// Replace the URL in the address bar without messing with the back button.
history.replaceState(null, null, cleanHref);
} else {
// Well, you're on an old browser, we can get rid of the _=_ but not the #.
window.location.hash = "";
}
}
循序渐进:
We'll only get into the code block if the fragment is #_=_. Check if the browser supports the HTML5 window.replaceState method. Clean the URL by splitting on # and taking only the first part. Tell history to replace the current page state with the clean URL. This modifies the current history entry instead of creating a new one. What this means is the back and forward buttons will work just the way you want. ;-) If the browser does not support the awesome HTML 5 history methods then just clean up the URL as best you can by setting the hash to empty string. This is a poor fallback because it still leaves a trailing hash (example.com/#) and also it adds a history entry, so the back button will take you back to #_-_.
了解更多关于历史的知识。
了解window.location的更多信息。
其他回答
将此添加到我的重定向页面解决了我的问题…
if (window.location.href.indexOf('#_=_') > 0) {
window.location = window.location.href.replace(/#.*/, '');
}
不知道他们为什么这样做，但是，你可以通过重置页面顶部的哈希来解决这个问题:
if (window.location.hash == "#_=_")
window.location.hash = "";
这是Facebook出于安全考虑而设计的。下面是Facebook团队成员埃里克·奥斯古德的解释:
This has been marked as 'by design' because it prevents a potential security vulnerability. Some browsers will append the hash fragment from a URL to the end of a new URL to which they have been redirected (if that new URL does not itself have a hash fragment). For example if example1.com returns a redirect to example2.com, then a browser going to example1.com#abc will go to example2.com#abc, and the hash fragment content from example1.com would be accessible to a script on example2.com. Since it is possible to have one auth flow redirect to another, it would be possible to have sensitive auth data from one app accessible to another. This is mitigated by appending a new hash fragment to the redirect URL to prevent this browser behavior. If the aesthetics, or client-side behavior, of the resulting URL are of concern, it would be possible to use window.location.hash (or even a server-side redirect of your own) to remove the offending characters.
来源:https://developers.facebook.com/bugs/318390728250352/
主要恼人的，特别是应用程序解析URI，而不只是读取$_GET…这是我拼凑出来的……享受吧!
<html xmlns:fb='http://www.facebook.com/2008/fbml'>
<head>
<script type="text/javascript">
// Get rid of the Facebook residue hash in the URI
// Must be done in JS cuz hash only exists client-side
// IE and Chrome version of the hack
if (String(window.location.hash).substring(0,1) == "#") {
window.location.hash = "";
window.location.href=window.location.href.slice(0, -1);
}
// Firefox version of the hack
if (String(location.hash).substring(0,1) == "#") {
location.hash = "";
location.href=location.href.substring(0,location.href.length-3);
}
</script>
</head>
<body>
URI should be clean
</body>
</html>
这将删除附加字符到您的url
<script type="text/javascript">
var idx=window.location.toString().indexOf("#_=_");
if (idx > 0) {
window.location = window.location.toString().substring(0, idx);
}
</script>
推荐文章
- 如何测试Facebook本地连接
- 如何在iOS中使用Swift编程segue
- Ajax会调用什么样的响应，比如'for (;;);{json data}的意思?
- React-Native:应用程序未注册错误
- Facebook:永久页面访问令牌?
- 调用线程必须是STA，因为许多UI组件都要求这一点
- 使用什么api来绘制其他应用程序(如Facebook的Chat Heads)?
- Android Facebook集成无效键散列
- 如何创建Android Facebook密钥哈希?
- Android-Facebook应用程序的键散列
- 如何找到并运行keytool
- Facebook API -如何通过Facebook API获得Facebook用户的个人资料图像(不需要用户“允许”应用程序)
- 如何从事件对象访问自定义属性在反应?
- Android Facebook风格幻灯片
- Facebook OAuth“这个URL的域名不包括在应用程序的域名中”
