FeatureJul 1, 2026

Fix redirect URL fragment encoding for single-page applications

Access now correctly preserves URL fragment characters (/, ?, =, &, ;) when redirecting users back to an application after login. Previously, these characters were encoded with encodeURIComponent, which mangled fragment-based routes used by single-page applications (SPAs).

For example, an SPA URL like https://app.example.com/#/dashboard?tab=settings&view=advanced would previously redirect to a broken URL after login. This is now handled correctly.

If your SPA users were experiencing broken navigation after authenticating through Access, this fix resolves the issue without any configuration changes.

Read the original announcement

All Access updates →

New strict service token authentication setting for Access
The strict service token authentication setting applies consistent behavior to requests made with service tokens. When the setting is on for a Zero Trust organization, Access handles requests with service token headers as follows:
AccessFeatureOct 2, 2026
Simplified permissions for tagging targets with Access for Infrastructure
You can now tag targets using only the Zero Trust Write API token permission. Previously, tagging targets through the API required both Zero Trust Write and Tag Write permissions on the API token.

Fix redirect URL fragment encoding for single-page applications

More from Access

Fix redirect URL fragment encoding for single-page applications

More from Access