Access - Fix redirect URL fragment encoding for single-page applications
- Announced
- Tags
- Access
- Severity
- info, set by
reef/rss-rule-v1 - Source
- https://developers.cloudflare.com/changelog/post/2026-07-01-spa-redirect-fragment-fix/
<p>Access now correctly preserves URL fragment characters (<code>/</code>, <code>?</code>, <code>=</code>, <code>&</code>, <code>;</code>) when redirecting users back to an application after login. Previously, these characters were encoded with <code>encodeURIComponent</code>, which mangled fragment-based routes used by single-page applications (SPAs).</p> <p>For example, an SPA URL like <code>https://app.example.com/#/dashboard?tab=settings&view=advanced</code> would previously redirect to a broken URL after login. This is now handled correctly.</p> <p>If your SPA users were experiencing broken navigation after authenticating through Access, this fix resolves the issue without any configuration changes.</p>
The text above is the source's. reef added the severity, the dates it could read from the text, and the endpoints and scopes named in code.