Anchor and anchor data being dropped when accessing a resource protected by Siteminder

Products

• SITEMINDER

Issue/Introduction

Named Anchors in a URL are designated with a "#" and the anchor data is to the right of the "#" 

EXAMPLE:  HTTP://<server>.<domain>.<TLD>/<path>#<anchor_data>

The purpose of a named anchor is to return specific data from the page being returned in the response.

When submitting a request to a resource protected by Siteminder, the anchor and anchor data appear to be getting dropped when the Siteminder Web Agent or Access Gateway redirects the web browser to a credential collector for authentication.

 

 

Environment

PRODUCT: Siteminder

COMPONENTS: Web Agent; Access Gateway

VERSION: ANY

Cause

The Named Anchor (#) is a Client-Side flag.  The anchor data is never sent to the web server by the web browser.  The anchor data is stripped by the web browser and cached prior to sending the request. The web browser cache's the anchor data on the web browser and applies it to the page in the 200 OK Response returned from the web server.  The web server and web agent never receive the anchor data in the Request.  

There are no problems with the anchor if the web browser has an SMSESSION cookie prior to sending the Request with the Named Anchor.  The request is sent, the web agent validates the SMSESSION cookie and returns the protected page as an HTTP 200 (OK).  The web browser has cached the anchor and applies the anchor data to the page correctly.

However, if the web browser does not have an SMSESSION cookie then the web agent redirects the web browser to the credential collector.  

A 302 redirect response is returned to the web browser rather than an HTTP 200.  The 302 places the original URL it received in the Target.  The named anchor is not applied to the 302 redirect.  Once the authentication is complete the user is redirected back to the URL in the Target.   

The web browser no longer has the cached anchors as that is only retained an applied to the response from the original GET.  The final redirect to the protected resource, therefore no longer has the anchor and anchor data.

 

Resolution

There is no means to configure the web agent or Access Gateway to handle the anchor.  This data is never sent to the web server/ web agent.  

You can configure a landing page, then protect the landing page with Siteminder.  The user will access the landing page, get prompted to authenticate, then be redirected back to the landing page with an SMSESSION cookie.  From the landing page, if the user now attempts to access the application URL with a Named Anchor, then that anchor will be applied by the web browser on the 200Ok Response.