Using PHP if that matters, on a site
https://www.example.com. I send a
Location header of
/member with a 302 status. The redirect works fine, but the address bar in the browser displays
What mechanism could be adding the
This happens with both Chrome and Firefox. I've run the code under Xdebug and verified there's no fragment in the string passed to
header(), and use Chrome developer tools to verify that the header sent does not contain the fragment. And using Xdebug in the destination code, the fragment is not present in
$_SERVER['REQUEST_URI'], though I guess that never contains any fragment anyway.
For more context, which might or might not be helpful, this occurs when logging in to a Zend Framework 1.12 MVC application, when the login succeeds and redirects to the start page for the logged-in member. When the login method uses an email address and password, there is no fragment. When it uses OAuth2 through Facebook, I get the
#_=_ fragment. When using OAuth2 through Google, I just get
#. That suggests to me that it's something in my code, but I don't even know how I could make those fragments show up in the address bar if I wanted to! And the code responsible for validating the login and doing the redirection is 90% common across all login methods - the OAuth-based methods just do the OAuth redirections to locate an entry in the user table, and once the entry is found the code is common to finding the entry by looking up an email address in the user table.