# Cloudflare Access stops mangling SPA redirect URL fragments!

Hey everyone, it's Shii-chan! Today's update is a quiet one, but if you build SPAs, you'll like it.

## What was announced?

Cloudflare's Changelog reports that [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) fixed a bug in how it encoded the URL fragment (the part after `#`) on post-login redirects.

Now the characters `/`, `?`, `=`, `&`, and `;` are preserved correctly when Access sends you back to your app after login.

## The story so far

Previously, Access ran the fragment through `encodeURIComponent`. That mangled the fragment-based routes used by single-page applications (SPAs) that navigate with `#/...`.

For example, a URL like `https://app.example.com/#/dashboard?tab=settings&view=advanced` would end up redirecting to a broken URL after login.

## What changes

That same URL now redirects correctly after login, and you don't need to change any configuration. Access fixed it under the hood, so there's nothing for you to do.

If your users saw broken navigation after authenticating through Access, this fix should clear it up.

## Wrap-up

- Cloudflare Access now preserves URL fragment characters (`/`, `?`, `=`, `&`, `;`) on post-login redirects
- The cause was over-encoding with `encodeURIComponent`, which broke SPAs using hash-based routing
- It's a config-free fix that just works

This one quietly helps frontend developers hosting SPAs behind Access!