blocks|key|5368322|text|不知道他们为什么要这么做，但是，你可以通过重置页面顶部的散列来解决这个问题：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5368323|if+(window.location.hash+==+"#_=_")
++window.location.hash+=+"";|code-block|syntax|javascript|5368324|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Not sure why they're doing this but, you could get around this by reseting the hash at the top of your page:

<pre class="lang-js prettyprint-override"><code>if (window.location.hash == "#_=_")
 window.location.hash = "";
</code></pre>

blocks|key|5368357|text|我看不出这个问题和facebook+AJAX有什么关系。事实上，禁用JavaScript和纯粹基于重定向的登录也会出现此问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5368358|与facebook的交流示例：|5368359|1.+GET+<https://www.facebook.com/dialog/oauth?client_id=MY_APP_ID&scope=email&redirect_uri=MY_REDIRECT_URL>+RESPONSE+302+Found+Location:+<https://www.facebook.com/connect/uiserver.php?[...]>++
2.+GET+<https://www.facebook.com/connect/uiserver.php?[...]>+RESPONSE+302+Found+MY_REDIRECT_URL?code=FB_CODE#_++
3.+GET+MY_REDIRECT_URL?code=FB_CODE#_++|code-block|syntax|javascript|5368360|对于我来说，只有Firefox才会发生这种情况。|5368361|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|O|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

I do not see how this problem is related to facebook AJAX. In fact the issue also occurs with JavaScript disabled and purely redirect based logins. 

An example exchange with facebook: 

<pre class="lang-html prettyprint-override"><code>1. GET &lt;https://www.facebook.com/dialog/oauth?client_id=MY_APP_ID&amp;scope=email&amp;redirect_uri=MY_REDIRECT_URL&gt; RESPONSE 302 Found Location: &lt;https://www.facebook.com/connect/uiserver.php?[...]&gt; 
2. GET &lt;https://www.facebook.com/connect/uiserver.php?[...]&gt; RESPONSE 302 Found MY_REDIRECT_URL?code=FB_CODE#_ 
3. GET MY_REDIRECT_URL?code=FB_CODE#_ 
</code></pre>

Happens only with Firefox for me too.

blocks|key|5368409|text|Facebook最近在处理会话重定向的方式上引入了一个变化。有关公告，请参阅本周Operation+Developer+Love博客文章中的“会话重定向行为中的更改”。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|5368410|entityMap|0|LINK|mutability|MUTABLE|url|https://developers.facebook.com/blog/post/552/^0|14|O|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

A change was introduced recently in how Facebook handles session redirects. See "Change in Session Redirect Behavior" in this week's <a href="https://developers.facebook.com/blog/post/552/" rel="nofollow">Operation Developer Love</a> blog post for the announcement.

blocks|key|1538261|text|通过Facebook's+Platform+Updates|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1538262|会话重定向行为中的|1538263|更改|blockquote|1538264|1538265|本周，当此字段保留为空时，我们开始向redirect_uri中添加片段#____=____。请确保您的应用程序可以处理此行为。|1538266|1538267|为了防止这种情况，在你的登录url请求中设置redirect_uri如下：(使用Facebook+php-sdk)|1538268|$facebook->getLoginUrl(array('redirect_uri'+=>+$_SERVER['SCRIPT_URI'],'scope'+=>+'user_about_me'));|code-block|syntax|javascript|1538269|更新|style|BOLD|1538270|以上就是documentation所说的解决这个问题的方法。然而，Facebook记录的解决方案并不起作用。请考虑在Facebook+Platform+Updates+blog+post上发表评论，并关注this+bug以获得更好的答案。在此之前，请在head标签中添加以下内容以解决此问题：|1538271|<script+type="text/javascript">
++++if+(window.location.hash+&&+window.location.hash+==+'#_=_')+{
++++++++window.location.hash+=+'';
++++}
</script>|1538272|或者一个更详细的替代方案(感谢niftylettuce)：|1538273|<script+type="text/javascript">
++++if+(window.location.hash+&&+window.location.hash+==+'#_=_')+{
++++++++if+(window.history+&&+history.pushState)+{
++++++++++++window.history.pushState("",+document.title,+window.location.pathname);
++++++++}+else+{
++++++++++++//+Prevent+scrolling+by+storing+the+page's+current+scroll+offset
++++++++++++var+scroll+=+{
++++++++++++++++top:+document.body.scrollTop,
++++++++++++++++left:+document.body.scrollLeft
++++++++++++};
++++++++++++window.location.hash+=+'';
++++++++++++//+Restore+the+scroll+offset,+should+be+flicker+free
++++++++++++document.body.scrollTop+=+scroll.top;
++++++++++++document.body.scrollLeft+=+scroll.left;
++++++++}
++++}
</script>|1538274|entityMap|0|LINK|mutability|MUTABLE|url|https://developers.facebook.com/blog/post/552/|1|2|3|http://developers.facebook.com/bugs/196125357123225|4|https://github.com/jaredhanson/passport-facebook/issues/12#issuecomment-5913711^0|2|R|0|0|0|0|0|0|0|0|0|0|2|0|4|D|1|1M|Z|2|2U|8|3|0|0|F|C|4|0|0^^$0|@$1|2|3|4|5|6|7|1J|8|@]|9|@$A|1K|B|1L|1|1M]]|C|$]]|$1|D|3|E|5|6|7|1N|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|1O|8|@]|9|@]|C|$]]|$1|I|3|-4|5|6|7|1P|8|@]|9|@]|C|$]]|$1|J|3|K|5|6|7|1Q|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|1R|8|@]|9|@]|C|$]]|$1|M|3|N|5|6|7|1S|8|@]|9|@]|C|$]]|$1|O|3|P|5|Q|7|1T|8|@]|9|@]|C|$R|S]]|$1|T|3|U|5|6|7|1U|8|@$A|1V|B|1W|V|W]]|9|@]|C|$]]|$1|X|3|Y|5|6|7|1X|8|@]|9|@$A|1Y|B|1Z|1|20]|$A|21|B|22|1|23]|$A|24|B|25|1|26]]|C|$]]|$1|Z|3|10|5|Q|7|27|8|@]|9|@]|C|$R|S]]|$1|11|3|12|5|6|7|28|8|@]|9|@$A|29|B|2A|1|2B]]|C|$]]|$1|13|3|14|5|Q|7|2C|8|@]|9|@]|C|$R|S]]|$1|15|3|-4|5|6|7|2D|8|@]|9|@]|C|$]]]|16|$17|$5|18|19|1A|C|$1B|1C]]|1D|$5|18|19|1A|C|$1B|1C]]|1E|$5|18|19|1A|C|$1B|1C]]|1F|$5|18|19|1A|C|$1B|1G]]|1H|$5|18|19|1A|C|$1B|1I]]]]

via <a href="https://developers.facebook.com/blog/post/552/" rel="noreferrer">Facebook's Platform Updates</a>:

<blockquote>
 Change in Session Redirect Behavior
 
 This week, we started adding a fragment #____=____ to the redirect_uri when
 this field is left blank. Please ensure that your app can handle this
 behavior.
</blockquote>

To prevent this, set the redirect_uri in your login url request like so: (using Facebook php-sdk)

<pre class="lang-php prettyprint-override"><code>$facebook-&gt;getLoginUrl(array('redirect_uri' =&gt; $_SERVER['SCRIPT_URI'],'scope' =&gt; 'user_about_me'));
</code></pre>

UPDATE

The above is exactly as the <a href="https://developers.facebook.com/blog/post/552/" rel="noreferrer">documentation</a> says to fix this. However, Facebook's documented solution does not work. Please consider leaving a comment on the <a href="https://developers.facebook.com/blog/post/552/" rel="noreferrer">Facebook Platform Updates blog post</a> and follow <a href="http://developers.facebook.com/bugs/196125357123225" rel="noreferrer">this bug</a> to get a better answer. Until then, add the following to your head tag to resolve this issue:

<pre class="lang-html prettyprint-override"><code>&lt;script type="text/javascript"&gt;
 if (window.location.hash &amp;&amp; window.location.hash == '#_=_') {
 window.location.hash = '';
 }
&lt;/script&gt;
</code></pre>

Or a more detailed alternative (thanks <a href="https://github.com/jaredhanson/passport-facebook/issues/12#issuecomment-5913711" rel="noreferrer">niftylettuce</a>):

<pre class="lang-html prettyprint-override"><code>&lt;script type="text/javascript"&gt;
 if (window.location.hash &amp;&amp; window.location.hash == '#_=_') {
 if (window.history &amp;&amp; history.pushState) {
 window.history.pushState("", document.title, window.location.pathname);
 } else {
 // Prevent scrolling by storing the page's current scroll offset
 var scroll = {
 top: document.body.scrollTop,
 left: document.body.scrollLeft
 };
 window.location.hash = '';
 // Restore the scroll offset, should be flicker free
 document.body.scrollTop = scroll.top;
 document.body.scrollLeft = scroll.left;
 }
 }
&lt;/script&gt;
</code></pre>

blocks|key|1841212|text|主要烦人，特别是对于解析URI而不仅仅是读取$_GET的应用程序……这是我拼凑出来的技巧。享受吧！|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1841213|<html+xmlns:fb='http://www.facebook.com/2008/fbml'>
<head>
++++++++<script+type="text/javascript">
++++++++//+Get+rid+of+the+Facebook+residue+hash+in+the+URI
++++++++//+Must+be+done+in+JS+cuz+hash+only+exists+client-side
++++++++//+IE+and+Chrome+version+of+the+hack
++++++++if+(String(window.location.hash).substring(0,1)+==+"#")+{
++++++++++++++++window.location.hash+=+"";
++++++++++++++++window.location.href=window.location.href.slice(0,+-1);
++++++++++++++++}
++++++++//+Firefox+version+of+the+hack
++++++++if+(String(location.hash).substring(0,1)+==+"#")+{
++++++++++++++++location.hash+=+"";
++++++++++++++++location.href=location.href.substring(0,location.href.length-3);
++++++++++++++++}
++++++++</script>
</head>
<body>
URI+should+be+clean
</body>
</html>|code-block|syntax|javascript|1841214|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Major annoying, especially for apps that parse the URI and not just read the $_GET... Here's the hack I threw together... Enjoy!

<pre class="lang-html prettyprint-override"><code>&lt;html xmlns:fb='http://www.facebook.com/2008/fbml'&gt;
&lt;head&gt;
 &lt;script type="text/javascript"&gt;
 // Get rid of the Facebook residue hash in the URI
 // Must be done in JS cuz hash only exists client-side
 // IE and Chrome version of the hack
 if (String(window.location.hash).substring(0,1) == "#") {
 window.location.hash = "";
 window.location.href=window.location.href.slice(0, -1);
 }
 // Firefox version of the hack
 if (String(location.hash).substring(0,1) == "#") {
 location.hash = "";
 location.href=location.href.substring(0,location.href.length-3);
 }
 &lt;/script&gt;
&lt;/head&gt;
&lt;body&gt;
URI should be clean
&lt;/body&gt;
&lt;/html&gt;
</code></pre>

blocks|key|1841227|text|如果要从url中删除剩余的"#“|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1841228|$(window).on('load',+function(e){
++if+(window.location.hash+==+'#_=_')+{
++++window.location.hash+=+'';+//+for+older+browsers,+leaves+a+#+behind
++++history.pushState('',+document.title,+window.location.pathname);+//+nice+and+clean
++++e.preventDefault();+//+no+page+reload
++}
})|code-block|syntax|javascript|1841229|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

if you want to remove the remaining "#" from the url

<pre class="lang-js prettyprint-override"><code>$(window).on('load', function(e){
 if (window.location.hash == '#_=_') {
 window.location.hash = ''; // for older browsers, leaves a # behind
 history.pushState('', document.title, window.location.pathname); // nice and clean
 e.preventDefault(); // no page reload
 }
})
</code></pre>

blocks|key|5368709|text|将此添加到我的重定向页面为我解决了这个问题...|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5368710|if+(window.location.href.indexOf('#_=_')+>+0)+{
++++window.location+=+window.location.href.replace(/#.*/,+'');
}|code-block|syntax|javascript|5368711|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Adding this to my redirect page fixed the problem for me ...

<pre class="lang-js prettyprint-override"><code>if (window.location.href.indexOf('#_=_') &gt; 0) {
 window.location = window.location.href.replace(/#.*/, '');
}
</code></pre>

blocks|key|1841326|text|您还可以在Facebook回调的redirect_uri参数上指定自己的散列，这在某些情况下可能会很有帮助，例如/api/account/callback#home。当你被重定向回来时，如果你使用的是backbone.js或类似的(对jquery+mobile不太确定)，那么它至少是一个与已知路由相对应的散列。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1841327|entityMap^0|G|C|1K|Q|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]|$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|M|8|@]|D|@]|E|$]]]|G|$]]

You can also specify your own hash on the <code>redirect_uri</code> parameter for the Facebook callback, which might be helpful in certain circumstances e.g. <code>/api/account/callback#home</code>. When you are redirected back, it'll at least be a hash that corresponds to a known route if you are using backbone.js or similar (not sure about jquery mobile).

blocks|key|5368849|text|TL;DR|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|5368850|if+(window.location.hash+===+"#_=_"){
++++history.replaceState+
++++++++?+history.replaceState(null,+null,+window.location.href.split("#")[0])
++++++++:+window.location.hash+=+"";
}|code-block|syntax|javascript|5368851|包含分步说明的完整版|5368852|//+Test+for+the+ugliness.
if+(window.location.hash+===+"#_=_"){

++++//+Check+if+the+browser+supports+history.replaceState.
++++if+(history.replaceState)+{

++++++++//+Keep+the+exact+URL+up+to+the+hash.
++++++++var+cleanHref+=+window.location.href.split("#")[0];

++++++++//+Replace+the+URL+in+the+address+bar+without+messing+with+the+back+button.
++++++++history.replaceState(null,+null,+cleanHref);

++++}+else+{

++++++++//+Well,+you're+on+an+old+browser,+we+can+get+rid+of+the+_=_+but+not+the+#.
++++++++window.location.hash+=+"";

++++}

}|5368853|一步一步：|5368854|当浏览器支持|5368855|方法时，如果fragment为#_=_.|ordered-list-item|CODE|5368856|Check，我们将只进入代码块。|5368857|通过在#上拆分并只取第一部分来清理URL。|5368858|告诉history用干净的URL替换当前页面状态。这将修改当前的历史记录条目，而不是创建新的历史条目。这意味着“后退”和“前进”按钮将以您想要的方式工作。;-)|5368859|5368860|5368861|​|5368862|5368863|如果浏览器不支持超棒的HTML5历史记录方法，那么只需通过将散列设置为空字符串来尽可能地清理URL。这是一个很糟糕的回退，因为它仍然会留下一个尾随的散列(example.com/#)，而且它还会添加一个历史记录条目，因此back按钮将把您带回#_-_。|5368864|5368865|了解有关history.replaceState的更多信息。|5368866|了解有关window.location的更多信息。|5368867|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.mozilla.org/en-US/docs/Web/Guide/DOM/Manipulating_the_browser_history#The_replaceState%2528%2529.C2.A0method|1|https://developer.mozilla.org/en-US/docs/Web/API/window.location#Properties^0|0|5|0|0|7|3|0|0|0|0|6|8|F|4|0|1|3|1|1|2|7|1|0|0|0|0|3D|4|0|0|4|K|4|K|0|0|4|F|4|F|1|0^^$0|@$1|2|3|4|5|6|7|1O|8|@$9|1P|A|1Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|1R|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|1S|8|@$9|1T|A|1U|B|C]]|D|@]|E|$]]|$1|M|3|N|5|H|7|1V|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|1W|8|@]|D|@]|E|$]]|$1|Q|3|R|5|6|7|1X|8|@]|D|@]|E|$]]|$1|S|3|T|5|U|7|1Y|8|@$9|1Z|A|20|B|V]|$9|21|A|22|B|V]]|D|@]|E|$]]|$1|W|3|X|5|U|7|23|8|@]|D|@]|E|$]]|$1|Y|3|Z|5|U|7|24|8|@$9|25|A|26|B|V]]|D|@]|E|$]]|$1|10|3|11|5|U|7|27|8|@$9|28|A|29|B|V]]|D|@]|E|$]]|$1|12|3|-4|5|6|7|2A|8|@]|D|@]|E|$]]|$1|13|3|-4|5|6|7|2B|8|@]|D|@]|E|$]]|$1|14|3|15|5|6|7|2C|8|@]|D|@]|E|$]]|$1|16|3|-4|5|6|7|2D|8|@]|D|@]|E|$]]|$1|17|3|18|5|U|7|2E|8|@$9|2F|A|2G|B|V]]|D|@]|E|$]]|$1|19|3|-4|5|6|7|2H|8|@]|D|@]|E|$]]|$1|1A|3|1B|5|6|7|2I|8|@$9|2J|A|2K|B|V]]|D|@$9|2L|A|2M|1|2N]]|E|$]]|$1|1C|3|1D|5|6|7|2O|8|@$9|2P|A|2Q|B|V]]|D|@$9|2R|A|2S|1|2T]]|E|$]]|$1|1E|3|-4|5|6|7|2U|8|@]|D|@]|E|$]]]|1F|$1G|$5|1H|1I|1J|E|$1K|1L]]|1M|$5|1H|1I|1J|E|$1K|1N]]]]

TL;DR

<pre class="lang-js prettyprint-override"><code>if (window.location.hash === "#_=_"){
 history.replaceState 
 ? history.replaceState(null, null, window.location.href.split("#")[0])
 : window.location.hash = "";
}
</code></pre>

Full version with step by step instructions

<pre class="lang-js prettyprint-override"><code>// Test for the ugliness.
if (window.location.hash === "#_=_"){

 // Check if the browser supports history.replaceState.
 if (history.replaceState) {

 // Keep the exact URL up to the hash.
 var cleanHref = window.location.href.split("#")[0];

 // Replace the URL in the address bar without messing with the back button.
 history.replaceState(null, null, cleanHref);

 } else {

 // Well, you're on an old browser, we can get rid of the _=_ but not the #.
 window.location.hash = "";

 }

}
</code></pre>

Step by step:

<ol>
<li>We'll only get into the code block if the <code>fragment</code> is <code>#_=_</code>.</li>
<li>Check if the browser supports the HTML5 <code>window.replaceState</code> method.

<ol>
<li>Clean the URL by splitting on <code>#</code> and taking only the first part.</li>
<li>Tell <code>history</code> to replace the current page state with the clean URL. This modifies the current history entry instead of creating a new one. What this means is the back and forward buttons will work just the way you want. ;-)</li>
</ol></li>
<li>If the browser does not support the awesome HTML 5 history methods then just clean up the URL as best you can by setting the hash to empty string. This is a poor fallback because it still leaves a trailing hash (example.com/#) and also it adds a history entry, so the back button will take you back to <code>#_-_</code>. </li>
</ol>

Learn more about <a href="https://developer.mozilla.org/en-US/docs/Web/Guide/DOM/Manipulating_the_browser_history#The_replaceState%28%29.C2.A0method" rel="noreferrer"><code>history.replaceState</code></a>.

Learn more about <a href="https://developer.mozilla.org/en-US/docs/Web/API/window.location#Properties" rel="noreferrer"><code>window.location</code></a>.

blocks|key|1538440|text|如果你正在使用JS框架和hashbang+(/#!/)+URL，比如Angular，这可能会成为一个严重的问题。实际上，Angular会将包含非hashbang片段的URL视为无效，并抛出一个错误：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1538441|Error:+Invalid+url+"http://example.com/#_=_",+missing+hash+prefix+"#!".|code-block|syntax|javascript|1538442|如果您在这种情况下(并且重定向到您的域根目录)，而不是执行以下操作：|1538443|window.location.hash+=+'';+//+goes+to+/#,+which+is+no+better|1538444|只需执行以下操作：|1538445|window.location.hash+=+'!';+//+goes+to+/#!,+which+allows+Angular+to+take+care+of+the+rest|1538446|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|S|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|U|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|V|8|@]|9|@]|A|$E|F]]|$1|O|3|-4|5|6|7|W|8|@]|9|@]|A|$]]]|P|$]]

This can become kind of a serious issue if you're using a JS framework with hashbang (/#!/) URLs, e.g. Angular. Indeed, Angular will consider URLs with a non-hashbang fragment as invalid and throw an error :

<pre><code>Error: Invalid url "http://example.com/#_=_", missing hash prefix "#!".
</code></pre>

If you're in such a case (and redirecting to your domain root), instead of doing :

<pre><code>window.location.hash = ''; // goes to /#, which is no better
</code></pre>

Simply do :

<pre><code>window.location.hash = '!'; // goes to /#!, which allows Angular to take care of the rest
</code></pre>

blocks|key|3951256|text|使用angular和angular+ui路由器，您可以修复此问题|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3951257|++++app.config(function+($stateProvider,+$urlRouterProvider,+$locationProvider)+{

++++++//+Make+a+trailing+slash+optional+for+all+routes
++++++//+-+Note:+You'll+need+to+specify+all+urls+with+a+trailing+slash+if+you+use+this+method.
++++++$urlRouterProvider.rule(function+($injector,+$location)+{
++++++++/***
++++++++Angular+misbehaves+when+the+URL+contains+a+"#_=_"+hash.

++++++++From+Facebook:
++++++++++Change+in+Session+Redirect+Behavior
++++++++++This+week,+we+started+adding+a+fragment+#_=_+to+the+redirect_uri+when+this+field+is+left+blank.
++++++++++Please+ensure+that+your+app+can+handle+this+behavior.

++++++++Fix:
++++++++++http://stackoverflow.com/questions/7131909/facebook-callback-appends-to-return-url#answer-7297873
++++++++***/
++++++++if+($location.hash()+===+'_=_'){
++++++++++$location.hash(null);
++++++++}

++++++++var+path+=+$location.url();

++++++++//+check+to+see+if+the+path+already+has+a+slash+where+it+should+be
++++++++if+(path[path.length+-+1]+===+'/'+%7C%7C+path.indexOf('/?')+>+-1)+{
++++++++++return;
++++++++}
++++++++else+if+(path.indexOf('?')+>+-1)+{
++++++++++$location.replace().path(path.replace('?',+'/?'));
++++++++}
++++++++else+{
++++++++++$location.replace().path(path+%2B+'/');
++++++++}
++++++});

++++++//+etc+...
++++});
});|code-block|syntax|javascript|3951258|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

With angular and angular ui router, you can fix this 

<pre><code> app.config(function ($stateProvider, $urlRouterProvider, $locationProvider) {

 // Make a trailing slash optional for all routes
 // - Note: You'll need to specify all urls with a trailing slash if you use this method.
 $urlRouterProvider.rule(function ($injector, $location) {
 /***
 Angular misbehaves when the URL contains a "#_=_" hash.

 From Facebook:
 Change in Session Redirect Behavior
 This week, we started adding a fragment #_=_ to the redirect_uri when this field is left blank.
 Please ensure that your app can handle this behavior.

 Fix:
 http://stackoverflow.com/questions/7131909/facebook-callback-appends-to-return-url#answer-7297873
 ***/
 if ($location.hash() === '_=_'){
 $location.hash(null);
 }

 var path = $location.url();

 // check to see if the path already has a slash where it should be
 if (path[path.length - 1] === '/' || path.indexOf('/?') &gt; -1) {
 return;
 }
 else if (path.indexOf('?') &gt; -1) {
 $location.replace().path(path.replace('?', '/?'));
 }
 else {
 $location.replace().path(path + '/');
 }
 });

 // etc ...
 });
});
</code></pre>

blocks|key|1841472|text|一个对我有效的变通方法(使用Backbone.js)是在传递给Facebook的重定向网址的末尾添加"#/“。Facebook将保留提供的片段，而不会附加自己的"_=_“。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1841473|在返回时，Backbone将删除"#/“部分。对于AngularJS，追加"#!“返回的URL应该是有效的。|1841474|请注意，大多数浏览器在重定向时(通过HTTP状态代码300、301、302和303)保留原始URL的片段标识符，除非重定向URL也具有片段标识符。这个seems+to+be+recommended+behaviour。|offset|length|1841475|如果您使用将用户重定向到其他地方的处理程序脚本，则可以在此处的重定向URL后附加"#“，以将片段标识符替换为空字符串。|1841476|entityMap|0|LINK|mutability|MUTABLE|url|http://www.w3.org/Protocols/HTTP/Fragment/draft-bos-http-redirect-00.txt^0|0|0|23|X|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@$F|U|G|V|1|W]]|A|$]]|$1|H|3|I|5|6|7|X|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

A workaround that worked for me (using Backbone.js), was to add "#/" to the end of the redirect URL passed to Facebook. Facebook will keep the provided fragment, and not append its own "_=_".

Upon return, Backbone will remove the "#/" part. For AngularJS, appending "#!" to the return URL should work.

Note that the fragment identifier of the original URL is preserved on redirection (via HTTP status codes 300, 301, 302 and 303) by most browsers, unless the redirect URL also has a fragment identifier. This <a href="http://www.w3.org/Protocols/HTTP/Fragment/draft-bos-http-redirect-00.txt" rel="nofollow">seems to be recommended behaviour</a>.

If you use a handler script that redirects the user elsewhere, you can append "#" to the redirect URL here to replace the fragment identifier with an empty string.

blocks|key|1538472|text|对我来说，为了摆脱#_=_，我将JavaScript重定向到另一个页面。下面的想法应该是可行的。:)|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1538473|function+redirect($url){
++++echo+"<script>window.location.href='{$url}?{$_SERVER["QUERY_STRING"]}'</script>";++++++++
}|code-block|syntax|javascript|1538474|entityMap^0|9|4|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

For me, i make JavaScript redirection to another page to get rid of <code>#_=_</code>. The ideas below should work. :)

<pre><code>function redirect($url){
 echo "&lt;script&gt;window.location.href='{$url}?{$_SERVER["QUERY_STRING"]}'&lt;/script&gt;"; 
}
</code></pre>

blocks|key|5368979|text|使用Angular+2+(RC5)和基于散列的路由，我这样做：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5368980|const+appRoutes:+Routes+=+[
++...
++{path:+'_',+redirectTo:+'/facebookLoginSuccess'},
++...
]|code-block|syntax|javascript|5368981|和|5368982|export+const+routing+=+RouterModule.forRoot(appRoutes,+{+useHash:+true+});|5368983|据我所知，路由中的=字符被解释为可选路由参数定义(参见https://angular.io/docs/ts/latest/guide/router.html#!#optional-route-parameters)的一部分，因此不涉及路由匹配。|offset|length|style|CODE|5368984|entityMap|0|LINK|mutability|MUTABLE|url|https://angular.io/docs/ts/latest/guide/router.html#!#optional-route-parameters^0|0|0|0|0|9|1|R|27|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|Z|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|10|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|11|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|12|8|@$M|13|N|14|O|P]]|9|@$M|15|N|16|1|17]]|A|$]]|$1|Q|3|-4|5|6|7|18|8|@]|9|@]|A|$]]]|R|$S|$5|T|U|V|A|$W|X]]]]

Using Angular 2 (RC5) and hash-based routes, I do this:

<pre><code>const appRoutes: Routes = [
 ...
 {path: '_', redirectTo: '/facebookLoginSuccess'},
 ...
]
</code></pre>

and

<pre><code>export const routing = RouterModule.forRoot(appRoutes, { useHash: true });
</code></pre>

As far as I understand, the <code>=</code> character in the route is interpreted as part of optional route parameters definition (see <a href="https://angular.io/docs/ts/latest/guide/router.html#!#optional-route-parameters" rel="nofollow">https://angular.io/docs/ts/latest/guide/router.html#!#optional-route-parameters</a>), so not involved in the route matching.

blocks|key|1542459|text|这是Facebook出于安全原因而设计实现的。以下是Facebook团队成员埃里克·奥斯古德的解释：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1542460|1542461|这已被标记为“有意设计”，因为它可以防止潜在的安全漏洞。|blockquote|1542462|1542463|一些浏览器会将来自URL的散列片段附加到它们被重定向到的新URL的末尾(如果该新URL本身没有散列片段)。|1542464|例如，如果example1.com返回到example2.com的重定向，则转到example1.com#abc的浏览器将转到example2.com#abc，example1.com中的散列片段内容将可由example2.com上的脚本访问。|1542465|由于可以将一个身份验证流重定向到另一个身份验证流，因此可以让来自一个应用程序的敏感身份验证数据可供另一个应用程序访问。|1542466|通过将新的散列片段附加到重定向URL以防止此浏览器行为，可以缓解此问题。|1542467|如果生成的URL的外观或客户端行为令人担忧，则可以使用window.location.hash+(甚至是您自己的服务器端重定向)来删除违规字符。|1542468|1542469|来源：https://developers.facebook.com/bugs/318390728250352/|offset|length|1542470|entityMap|0|LINK|mutability|MUTABLE|url|https://developers.facebook.com/bugs/318390728250352/^0|0|0|0|0|0|0|0|0|0|0|3|1H|0|0^^$0|@$1|2|3|4|5|6|7|13|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|14|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|15|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|16|8|@]|9|@]|A|$]]|$1|G|3|H|5|6|7|17|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|18|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|19|8|@]|9|@]|A|$]]|$1|M|3|N|5|6|7|1A|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1B|8|@]|9|@]|A|$]]|$1|Q|3|-4|5|6|7|1C|8|@]|9|@]|A|$]]|$1|R|3|S|5|6|7|1D|8|@]|9|@$T|1E|U|1F|1|1G]]|A|$]]|$1|V|3|-4|5|6|7|1H|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12]]]]

This was implemented by Facebook by design for security reasons. Here's the explanation from Eric Osgood, a Facebook Team member:

<blockquote>
 This has been marked as 'by design'
 because it prevents a potential security vulnerability.
 
 Some browsers will append the hash fragment from a URL to the end of a
 new URL to which they have been redirected (if that new URL does not
 itself have a hash fragment).
 
 For example if example1.com returns a redirect to example2.com, then a
 browser going to example1.com#abc will go to example2.com#abc, and the
 hash fragment content from example1.com would be accessible to a
 script on example2.com.
 
 Since it is possible to have one auth flow redirect to another, it
 would be possible to have sensitive auth data from one app accessible
 to another.
 
 This is mitigated by appending a new hash fragment to the redirect URL
 to prevent this browser behavior.
 
 If the aesthetics, or client-side behavior, of the resulting URL are
 of concern, it would be possible to use window.location.hash (or even
 a server-side redirect of your own) to remove the offending
 characters.
</blockquote>

Source: <a href="https://developers.facebook.com/bugs/318390728250352/" rel="noreferrer">https://developers.facebook.com/bugs/318390728250352/</a>

blocks|key|5369029|text|我知道这个回复很晚，但是如果你使用的是passportjs，你可能会想看看这个。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5369030|return+(req,+res,+next)+=>+{
++++console.log(req.originalUrl);
++++next();
};|code-block|syntax|javascript|5369031|我已经编写了这个中间件，并将其应用于express服务器实例，我得到的原始URL没有"#_=_"。当我们将passporJS的实例作为中间件应用到服务器实例时，它看起来像是这样，它不接受这些字符，但只在浏览器的地址栏中可见。|offset|length|style|CODE|5369032|entityMap^0|0|0|16|6|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@$I|R|J|S|K|L]]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

I know this reply is late, but if you are using passportjs, you might want to see this. 

<pre><code>return (req, res, next) =&gt; {
 console.log(req.originalUrl);
 next();
};
</code></pre>

I have written this middleware and applied it to express server instance, and the original URL I've got is without the <code>"#_=_"</code>. Looks like it when we apply passporJS' instance as middleware to the server instance, it doesn't take those characters, but are only visible on the address bar of our browsers.

blocks|key|5369045|text|我也用这个来删除'#‘符号。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5369046|<script+type="text/javascript">
++++if+(window.location.hash+&&+window.location.hash+==+'#_=_')+{
++++++++window.location.href+=+window.location.href.split('#_=_')[0];
++++}
</script>|code-block|syntax|javascript|5369047|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

I use this one, to delete '#' symbol as well.

<pre><code>&lt;script type="text/javascript"&gt;
 if (window.location.hash &amp;&amp; window.location.hash == '#_=_') {
 window.location.href = window.location.href.split('#_=_')[0];
 }
&lt;/script&gt;
</code></pre>

blocks|key|3951364|text|适用于PHP+SDK用户的|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3951365|我在转发之前删除了额外的部分，简单地解决了这个问题。|3951366|+$loginURL+=+$helper->getLoginUrl($redirectURL,+$fbPermissions);
+$loginURL+=+str_replace("#_=_",+"",+$loginURL);
+header("Location:+"+.+$loginURL);|code-block|syntax|javascript|3951367|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|L|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|M|8|@]|9|@]|A|$G|H]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

For PHP SDK users

I fixed the problem simply by removing the extra part before forwarding.

<pre><code> $loginURL = $helper-&gt;getLoginUrl($redirectURL, $fbPermissions);
 $loginURL = str_replace("#_=_", "", $loginURL);
 header("Location: " . $loginURL);
</code></pre>

blocks|key|5369084|text|这将删除url中附加的字符。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5369085|<script+type="text/javascript">
+var+idx=window.location.toString().indexOf("#_=_");+
+++if+(idx+>+0)+{+
+++++window.location+=+window.location.toString().substring(0,+idx);+
+++}+
</script>|code-block|syntax|javascript|5369086|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

This would remove the appended characters to your url

<pre><code>&lt;script type="text/javascript"&gt;
 var idx=window.location.toString().indexOf("#_=_"); 
 if (idx &gt; 0) { 
 window.location = window.location.toString().substring(0, idx); 
 } 
&lt;/script&gt;
</code></pre>

blocks|key|3951397|text|如果您使用的是vue-router，您可以添加到路由列表中：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3951398|{
++path:+'/_=_',
++redirect:+'/',+//+<--+or+other+default+route
},|code-block|syntax|javascript|3951399|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If you're using vue-router, you can append to the list of routes:

<pre><code>{
 path: '/_=_',
 redirect: '/', // &lt;-- or other default route
},
</code></pre>

blocks|key|1841628|text|删除"#_=_“(PHP)最简单、最干净的解决方案：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1841629|而不是"header("Location:+xxx.php");“来使用"echo+("location.href+=+'xxx.php';");”|1841630|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

The easiest and clean solution to remove &quot;&#35;&#95;&#61;&#95;&quot; (PHP):

Instead of "header("Location: xxx.php");" to use "echo ("location.href = 'xxx.php';");"

blocks|key|3951427|text|对于那些正在寻找简单答案的人，只需添加以下内容，它对我很有效|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3951428|if+(window.location.hash+===+"#_=_"){
++++history.replaceState+
++++++++?+history.replaceState(null,+null,+window.location.href.split("#")[0])
++++++++:+window.location.hash+=+"";
}|code-block|syntax|javascript|3951429|也可以查看Paul+Schwarz的完整答案|3951430|https://stackoverflow.com/a/18305085/2694806|offset|length|3951431|entityMap|0|LINK|mutability|MUTABLE|url^0|0|0|0|0|18|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|U|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|V|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|W|8|@]|9|@$K|X|L|Y|1|Z]]|A|$]]|$1|M|3|-4|5|6|7|10|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|J]]]]

For those who are looking for simple answer
Just add this , it worked for me
<pre><code>if (window.location.hash === &quot;#_=_&quot;){
 history.replaceState 
 ? history.replaceState(null, null, window.location.href.split(&quot;#&quot;)[0])
 : window.location.hash = &quot;&quot;;
}
</code></pre>
Check the full answer by Paul Schwarz as well
<a href="https://stackoverflow.com/a/18305085/2694806">https://stackoverflow.com/a/18305085/2694806</a>

Facebook callback has started appending <code>#_=_</code> hash underscore to the Return URL

Does anyone know why? What is the solution?

Facebook Callback appends '#_=_' to Return URL

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

Facebook回调已开始将#_=_散列下划线附加到返回URL有人知道为什么吗？解决方案是什么？

问Facebook回调将'#_=_‘附加到返回的URL
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Facebook回调将'#_=_‘附加到返回的URLEN