Cloudflare Access stops mangling SPA redirect URL fragments!

Hey everyone, it's Shii-chan! Today's update is a quiet one, but if you build SPAs, you'll like it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog reports that Cloudflare Access fixed a bug in how it encoded the URL fragment (the part after #) on post-login redirects.

Now the characters /, ?, =, &, and ; are preserved correctly when Access sends you back to your app after login.

The story so far

Previously, Access ran the fragment through encodeURIComponent. That mangled the fragment-based routes used by single-page applications (SPAs) that navigate with #/....

For example, a URL like https://app.example.com/#/dashboard?tab=settings&view=advanced would end up redirecting to a broken URL after login.

What changes

That same URL now redirects correctly after login, and you don't need to change any configuration. Access fixed it under the hood, so there's nothing for you to do.

If your users saw broken navigation after authenticating through Access, this fix should clear it up.

Wrap-up

• Cloudflare Access now preserves URL fragment characters (/, ?, =, &, ;) on post-login redirects
• The cause was over-encoding with encodeURIComponent, which broke SPAs using hash-based routing
• It's a config-free fix that just works

This one quietly helps frontend developers hosting SPAs behind Access!