Facebook回调附加“#_=_”到返回URL

Facebook回调已经开始追加#_=_哈希下划线返回URL

有人知道为什么吗?解决方案是什么?

当前回答

你也可以在Facebook回调的redirect_uri参数上指定你自己的散列，这在某些情况下可能是有帮助的，例如/api/account/callback#home。当你被重定向回来，它至少是一个哈希，对应于一个已知的路由，如果你使用backbone.js或类似的(不确定jquery移动)。

2013-04-30 16:43:46

其他回答

这是Facebook出于安全考虑而设计的。下面是Facebook团队成员埃里克·奥斯古德的解释:

This has been marked as 'by design' because it prevents a potential security vulnerability. Some browsers will append the hash fragment from a URL to the end of a new URL to which they have been redirected (if that new URL does not itself have a hash fragment). For example if example1.com returns a redirect to example2.com, then a browser going to example1.com#abc will go to example2.com#abc, and the hash fragment content from example1.com would be accessible to a script on example2.com. Since it is possible to have one auth flow redirect to another, it would be possible to have sensitive auth data from one app accessible to another. This is mitigated by appending a new hash fragment to the redirect URL to prevent this browser behavior. If the aesthetics, or client-side behavior, of the resulting URL are of concern, it would be possible to use window.location.hash (or even a server-side redirect of your own) to remove the offending characters.

来源:https://developers.facebook.com/bugs/318390728250352/

2017-01-29 03:25:34

不知道他们为什么这样做，但是，你可以通过重置页面顶部的哈希来解决这个问题:

if (window.location.hash == "#_=_")
  window.location.hash = "";

2011-08-21 18:54:47

我看不出这个问题与facebook AJAX有什么关系。事实上，禁用JavaScript和完全基于重定向的登录也会出现这个问题。

一个与facebook交换的例子:

1. GET <https://www.facebook.com/dialog/oauth?client_id=MY_APP_ID&scope=email&redirect_uri=MY_REDIRECT_URL> RESPONSE 302 Found Location: <https://www.facebook.com/connect/uiserver.php?[...]>  
2. GET <https://www.facebook.com/connect/uiserver.php?[...]> RESPONSE 302 Found MY_REDIRECT_URL?code=FB_CODE#_  
3. GET MY_REDIRECT_URL?code=FB_CODE#_

我也只在火狐浏览器上遇到过这种情况。

2011-08-26 13:30:50

如果你使用vue-router，你可以添加到路由列表:

{
  path: '/_=_',
  redirect: '/', // <-- or other default route
},

2018-11-12 14:37:02

主要恼人的，特别是应用程序解析URI，而不只是读取$_GET…这是我拼凑出来的……享受吧!

<html xmlns:fb='http://www.facebook.com/2008/fbml'>
<head>
        <script type="text/javascript">
        // Get rid of the Facebook residue hash in the URI
        // Must be done in JS cuz hash only exists client-side
        // IE and Chrome version of the hack
        if (String(window.location.hash).substring(0,1) == "#") {
                window.location.hash = "";
                window.location.href=window.location.href.slice(0, -1);
                }
        // Firefox version of the hack
        if (String(location.hash).substring(0,1) == "#") {
                location.hash = "";
                location.href=location.href.substring(0,location.href.length-3);
                }
        </script>
</head>
<body>
URI should be clean
</body>
</html>

2012-01-01 00:36:39

Facebook回调附加“#_=_”到返回URL

推荐文章

最新文章

标签