title: After 302 redirect, browser redirect to wrong location after implicit Oauth2 authentication, and access token fragment missing
body: <p>I have an Oauth2 authorization server based on springboot 2. </p>
  
  <p>I have an application SPA based on react.js.</p>
  
  <p>I want to generate an accessToken , for that i chose the implicit garant_type.
  the flow working well, i get the access_token, but can't read the access_token fragment from my front application. The browser dont redirect to the 302 location www.example.com/conetext-path/index.hrml#access_token=azerty, the browser redirect to www.example.com/conetext-path/ and the fragment disappears. </p>
  
  <p>See below the different exchanges with the server:</p>
  
  <blockquote>
    <p><b>1-</b>
    GET <a href="https://www.example.com/api/auth/oauth/authorize?response_type=token&amp;client_id=my-trusted-client&amp;redirect_uri=https://www.example.com/context-apth/index.html&amp;scope=read" rel="nofollow noreferrer">https://www.example.com/api/auth/oauth/authorize?response_type=token&amp;client_id=my-trusted-client&amp;redirect_uri=https://www.example.com/context-apth/index.html&amp;scope=read</a></p>
  </blockquote>
  
  <p><b>RESPONSE: </b></p>
  
  <pre><code>HTTP/1.1 302
  Access-Control-Allow-Headers: x-requested-with, authorization
  Access-Control-Allow-Methods: GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS,TRACE
  Access-Control-Allow-Origin: *
  Access-Control-Max-Age: 3600
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Date: Sun, 06 Oct 2019 19:01:56 GMT
  Expires: 0
  Location: https://www.example.com/context-path/login
  Pragma: no-cache
  Server: nginx/1.15.10
  Strict-Transport-Security: max-age=31536000 ; includeSubDomains
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  Content-Length: 0
  Connection: keep-alive 
  </code></pre>
  
  <blockquote>
    <p>2- POST <a href="https://www.example.com/context-path/login" rel="nofollow noreferrer">https://www.example.com/context-path/login</a> with credentials </p>
  </blockquote>
  
  <p><b>RESPONSE:</b> </p>
  
  <pre><code>HTTP/1.1 302
  Access-Control-Allow-Headers: x-requested-with, authorization
  Access-Control-Allow-Methods: GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS,TRACE
  Access-Control-Allow-Origin: *
  Access-Control-Max-Age: 3600
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  Date: Sun, 06 Oct 2019 19:05:35 GMT
  Expires: 0 
  Location: https://www.example.com/api/auth/oauth/authorize?response_type=token&amp;client_id=my-trusted-client&amp;redirect_uri=https://www.example.com/context-apth/index.html&amp;scope=read
  Pragma: no-cache
  Server: nginx/1.15.10
  Set-Cookie: JSESSIONID=B08832A4F924A500DBB5C8F38034996D; Path=/api/auth; Secure; HttpOnly
  Strict-Transport-Security: max-age=31536000 ; includeSubDomains
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  Content-Length: 0
  Connection: keep-alive
  </code></pre>
  
  <blockquote>
    <p><b>3- </b> 302 redirect result after login </p>
  </blockquote>
  
  <p><b> RESPONSE </b></p>
  
  <pre><code>Access-Control-Allow-Headers: x-requested-with, authorization
  Access-Control-Allow-Methods: GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS,TRACE
  Access-Control-Allow-Origin: *
  Access-Control-Max-Age: 3600
  Cache-Control: no-store
  Connection: keep-alive
  Content-Language: fr-FR
  Content-Length: 0
  Date: Sun, 06 Oct 2019 19:05:35 GMT
  Location: https://www.example.com/context-path/index.html#access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsib2F1dGgyLXJlc291cmNlIl0sInVzZXJfbmFtZSI6IkFnZW50X21haGRpX2thbGxlbCIsIlRFTkFOVF9DUkVDSEUiOjEsInNjb3BlIjpbInJlYWQiXSwiZXhwIjoxNTcwNDE4NzM1LCJhdXRob3JpdGllcyI6WyJBR0VOVF9DUkVDSEVfTk9OX0NPTkZJUk1FIiwiQUdFTlRfQ1JFQ0hFX0NPTkZJUk1FIiwiQURNSU5fQ1JFQ0hFIl0sImp0aSI6ImJmYzUzN2Y2LTA2ZDgtNGUxMS1hNTA3LTc0ZmRlNDgzMzVhNCIsImNsaWVudF9pZCI6Im15LXRydXN0ZWQtY2xpZW50In0.qoEEBIy2x-ABlXIEYeilfW-X4U8sOMTdZrEqLWFJ4Kc&amp;token_type=bearer&amp;expires_in=30000
  Server: nginx/1.15.10
  Strict-Transport-Security: max-age=31536000 ; includeSubDomains
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  </code></pre>
  
  <blockquote>
    <p><b>4-</b> im redirected to /index.html:  </p>
  </blockquote>
  
  <p><b> RESPONSE </b> </p>
  
  <pre><code>HTTP/1.1 200 OK
  Content-Encoding: gzip
  Content-Type: text/html
  Date: Sun, 06 Oct 2019 18:48:22 GMT
  ETag: W/"5d989034-a83"
  Last-Modified: Sat, 05 Oct 2019 12:44:36 GMT
  Server: nginx/1.15.10
  Vary: Accept-Encoding
  Content-Length: 1250
  </code></pre>
  
  <p><b> but on the browser location i see the url <a href="https://www.example.com/context-path/" rel="nofollow noreferrer">https://www.example.com/context-path/</a> instead of <a href="https://www.example.com/context-path/index.html" rel="nofollow noreferrer">https://www.example.com/context-path/index.html</a>. </b></p>
  
  <p>Inside index.html I have a javascript script looking for the fragment access_token, but its null.</p>
  
  <p>I don't understand why the browser not redirecting to the location with the fragment.</p>