I have a DAV protocol that stores out-of-band data in the url anchor, e.g. the ghi
in DELETE /abc.def#ghi
. The server is a Flask application.
I ran into the same problem. Facebook authentication API returns the access token behind a hash appended into the redirection url. In the same way, Flask's request.url drops everything in the URL behind the hash sign.
I'm also using Flask so I think you can use my brute-force workaround using Javascript's window.location.href to get the full URL. Then, I just extracted the piece that I needed (the access token), put it into a redirection URL where I can pass the access token as an argument to the receiving view function. Here's the code:
@app.route('/app_response/', methods=['GET'])
def app_response_code(response):
return ''' '''
@app.route('/app_response_token//', methods=['GET'])
def app_response_token(token):
return token
In case you manage(d) to do this within Werkzeug, I'm interested to know how.