hashtags (#) in URL encoded parameters decoded on redirect

Question

I have a two server system... one hosting the app and the other hosting the authentication/authorization. When the app detects the user isn\'t logged in yet, it redirects t

Answer 1

Not sure if it is the best solution or even if you can control this, but it may work if you do double-encoding: for example, instead of "%23", make it use "%2523".

The unwanted decoding should then convert "%2523" to "%23", leaving the desired result in the redirect URL that the browser shows.

Answer 2

You need to URI-escape the "#" character.