Javascript 302重定向后，浏览器在隐式Oauth2身份验证后重定向到错误位置，访问令牌片段丢失

我有一个基于Springboot2的Oauth2授权服务器

我有一个基于react.js的应用程序SPA

我想生成一个accessToken，为此我选择了隐式garant_类型。 流程运行良好，我获得了访问令牌，但无法从前端应用程序读取访问令牌片段。浏览器不重定向到302位置www.example.com/conetext path/index.hrml#access_token=azerty，浏览器重定向到www.example.com/conetext-path/，片段消失

请参见以下与服务器的不同交换：

一,- 得到

答复：

2-使用凭证发布

答复：

3-302登录后的重定向结果

回应

4-im重定向到/index.html：

回应

但在浏览器位置上，我看到的是url而不是

在index.html中，我有一个javascript脚本寻找片段access_标记，但它为null

---

我不明白为什么浏览器没有重定向到带有片段的位置。

可能是您的代码有问题-一堆响应标题没有给出代码是什么1。检查：ngix服务器路径和规则，可能路径index.html被翻译成/。2.尝试复制/粘贴完整url http://../index.html#token=。。。看看是什么。3.检查应用程序重定向url@Max当我再次在浏览器上调用时，一切正常，broswer将我重定向到，我可以读取片段，我看不出第一个重定向和第二个重定向之间有什么区别

HTTP/1.1 302
Access-Control-Allow-Headers: x-requested-with, authorization
Access-Control-Allow-Methods: GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS,TRACE
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Date: Sun, 06 Oct 2019 19:01:56 GMT
Expires: 0
Location: https://www.example.com/context-path/login
Pragma: no-cache
Server: nginx/1.15.10
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Length: 0
Connection: keep-alive 

HTTP/1.1 302
Access-Control-Allow-Headers: x-requested-with, authorization
Access-Control-Allow-Methods: GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS,TRACE
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Date: Sun, 06 Oct 2019 19:05:35 GMT
Expires: 0 
Location: https://www.example.com/api/auth/oauth/authorize?response_type=token&client_id=my-trusted-client&redirect_uri=https://www.example.com/context-apth/index.html&scope=read
Pragma: no-cache
Server: nginx/1.15.10
Set-Cookie: JSESSIONID=B08832A4F924A500DBB5C8F38034996D; Path=/api/auth; Secure; HttpOnly
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Content-Length: 0
Connection: keep-alive

Access-Control-Allow-Headers: x-requested-with, authorization
Access-Control-Allow-Methods: GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS,TRACE
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600
Cache-Control: no-store
Connection: keep-alive
Content-Language: fr-FR
Content-Length: 0
Date: Sun, 06 Oct 2019 19:05:35 GMT
Location: https://www.example.com/context-path/index.html#access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOlsib2F1dGgyLXJlc291cmNlIl0sInVzZXJfbmFtZSI6IkFnZW50X21haGRpX2thbGxlbCIsIlRFTkFOVF9DUkVDSEUiOjEsInNjb3BlIjpbInJlYWQiXSwiZXhwIjoxNTcwNDE4NzM1LCJhdXRob3JpdGllcyI6WyJBR0VOVF9DUkVDSEVfTk9OX0NPTkZJUk1FIiwiQUdFTlRfQ1JFQ0hFX0NPTkZJUk1FIiwiQURNSU5fQ1JFQ0hFIl0sImp0aSI6ImJmYzUzN2Y2LTA2ZDgtNGUxMS1hNTA3LTc0ZmRlNDgzMzVhNCIsImNsaWVudF9pZCI6Im15LXRydXN0ZWQtY2xpZW50In0.qoEEBIy2x-ABlXIEYeilfW-X4U8sOMTdZrEqLWFJ4Kc&token_type=bearer&expires_in=30000
Server: nginx/1.15.10
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/html
Date: Sun, 06 Oct 2019 18:48:22 GMT
ETag: W/"5d989034-a83"
Last-Modified: Sat, 05 Oct 2019 12:44:36 GMT
Server: nginx/1.15.10
Vary: Accept-Encoding
Content-Length: 1250