title: URL fragment lost as part of SAML token authentication; workaround / standard pattern?
body: <p>Several web application authentication protocols (like WS-Federation and the SAML protocol, i.e., so-called 'passive' protocols, and apparently also ASP.NET Forms authentication, see <a href="https://stackoverflow.com/q/7270066/223837">this StackOverflow question</a>, and AppEngine, see <a href="https://code.google.com/p/google-web-toolkit/issues/detail?id=7101#c14" rel="nofollow noreferrer">this GWT bug comment</a>) lose the original 'URL fragment', i.e. the part after the #-sign.</p>
  
  <p>What happens is roughly the following: in a clean browser (so no cached info/cookies/login information) I open URL (1) <a href="http://example.com/myapp/somepage?some=parameter#somewhere" rel="nofollow noreferrer">http://example.com/myapp/somepage?some=parameter#somewhere</a>.  This makes the browser request (2) <a href="http://example.com/myapp/somepage?some=parameter" rel="nofollow noreferrer">http://example.com/myapp/somepage?some=parameter</a>, the server redirects me to my identity provider (including URL (2) in the authentication request), and ultimately I'm redirected back to where I came from, which is URL (2): that is the only URL that the server knows about.  But I wanted to go to URL (1), and the URL fragment ('anchor') has been lost along the way, actually in the first step already.</p>
  
  <p>This seems to be a fundamental limitation of these protocols, since the server never sees the URL fragment at all.</p>
  
  <p>I know that it according to specifications that the browser requests (2) from the server, when I navigate to (1), leading to this fragment-losing limitation on the SAML protocol, WS-Federation, etc.  My question is: how do I work around this limitation?</p>
  
  <p>The obvious workaround is to avoid URL fragments, as suggested in <a href="https://stackoverflow.com/a/7270108/223837">this answer</a>.  However, for our specific web application that is not nice, since we use bookmarkable URL fragments in our single-page GWT application, to make sure that a navigation within our application does not cause the page to reload.</p>
  
  <p>My question: What other workarounds or standard patterns are there for this situation?</p>
  
  <p>(I'm specifically interested in a GWT + SAML protocol solution.)</p>