Recorded 14 Oct 2026 at 10:19 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.
Empty fragments will be appended to every HTTP redirect from the login endpoint.
Effective date: February 8, 2020 Endpoints impacted: Both v1.0 and v2.0 Protocol impacted: OAuth and OIDC flows that use response_type=query - this covers the authorization code flow in some cases, and the implicit flow. When an authentication response is sent from login.microsoftonline.com to an application via HTTP redirect, the service will append an empty fragment to the reply URL. This prevents a class of redirect attacks by ensuring that the browser wipes out any existing fragment in the authentication request. No apps should have a dependency on this behavior.
What it said
- Published
- 1 Feb 2020
- Product
- Microsoft Entra
Recorded links
What changed
First observed 14 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.