Very strange symptom after I've switched to mod_auth_openidc - spontaneous page fragment "#" added

[nneul]

Has anyone seen anything with use of mod_auth_openidc where a page fragment is spontaneously added to the URL?

i.e. ie access https://somesite/resource
and the auth redirects after flow with location: back to https://somesite/resource

but then the browser ends up on https://somesite/resource#

I even tested accessing a text/plain URL, just in case there was some weird javascript thing going on - no change. It still does it. It's like chrome is reacting to something in the redirect process.

I'm ONLY seeing it on the pages after I've switched to mod_auth_openidc, and only on Chrome. I do not see it on FF.

Anyone seen anything like this before?

[zandbelt]

Are you using any of OIDCPreservePost, OIDCResponseType or OIDCResponseMode?

[nneul]

No, none of those in use. I can't see any indication that the # is in any of the responses sent from the server when looking at developer console - it's almost as if the client side is deciding it needs to add the fragment, but I don't see why. i.e. It is NOT present in any Location header.

[zandbelt]

yeah, since it is only Chrome, I think the root cause is in there