我知道这个回复晚了，但如果您正在使用passportjs，您可能想看到这个。

return (req, res, next) => {
    console.log(req.originalUrl);
    next();
};

我已经编写了这个中间件，并将其应用于表示服务器实例，我得到的原始URL没有“#_=_”。看起来，当我们将passporJS的实例作为中间件应用到服务器实例时，它不接受这些字符，而只在浏览器的地址栏上可见。

博士TL;

if (window.location.hash === "#_=_"){
    history.replaceState 
        ? history.replaceState(null, null, window.location.href.split("#")[0])
        : window.location.hash = "";
}

完整版本与一步一步的说明

// Test for the ugliness.
if (window.location.hash === "#_=_"){

    // Check if the browser supports history.replaceState.
    if (history.replaceState) {

        // Keep the exact URL up to the hash.
        var cleanHref = window.location.href.split("#")[0];

        // Replace the URL in the address bar without messing with the back button.
        history.replaceState(null, null, cleanHref);

    } else {

        // Well, you're on an old browser, we can get rid of the _=_ but not the #.
        window.location.hash = "";

    }

}

循序渐进:

We'll only get into the code block if the fragment is #_=_. Check if the browser supports the HTML5 window.replaceState method. Clean the URL by splitting on # and taking only the first part. Tell history to replace the current page state with the clean URL. This modifies the current history entry instead of creating a new one. What this means is the back and forward buttons will work just the way you want. ;-) If the browser does not support the awesome HTML 5 history methods then just clean up the URL as best you can by setting the hash to empty string. This is a poor fallback because it still leaves a trailing hash (example.com/#) and also it adds a history entry, so the back button will take you back to #_-_.

了解更多关于历史的知识。

了解window.location的更多信息。

Facebook最近在处理会话重定向的方式上做出了改变。有关公告，请参阅本周Operation Developer Love博客文章中的“会话重定向行为的更改”。

我看不出这个问题与facebook AJAX有什么关系。事实上，禁用JavaScript和完全基于重定向的登录也会出现这个问题。

一个与facebook交换的例子:

1. GET <https://www.facebook.com/dialog/oauth?client_id=MY_APP_ID&scope=email&redirect_uri=MY_REDIRECT_URL> RESPONSE 302 Found Location: <https://www.facebook.com/connect/uiserver.php?[...]>  
2. GET <https://www.facebook.com/connect/uiserver.php?[...]> RESPONSE 302 Found MY_REDIRECT_URL?code=FB_CODE#_  
3. GET MY_REDIRECT_URL?code=FB_CODE#_  

我也只在火狐浏览器上遇到过这种情况。

对我来说，我让JavaScript重定向到另一个页面，以摆脱#_=_。下面的想法应该有用。：）

function redirect($url){
    echo "<script>window.location.href='{$url}?{$_SERVER["QUERY_STRING"]}'</script>";        
}

如果您想从url中删除剩余的“#”

$(window).on('load', function(e){
  if (window.location.hash == '#_=_') {
    window.location.hash = ''; // for older browsers, leaves a # behind
    history.pushState('', document.title, window.location.pathname); // nice and clean
    e.preventDefault(); // no page reload
  }
})