@mparticle/web-sdk 3.22.0 → 3.23.0

package/dist/types/src/pageUrl.d.ts

@@ -0,0 +1,10 @@
+import { valueof } from './utils';
+export declare const UrlMode: {
+    readonly Path: "path";
+    readonly Full: "full";
+};
+export type UrlMode = valueof<typeof UrlMode>;
+export declare const EXCLUDED_URL_QUERY_PARAMS: string[];
+export declare const EXCLUDED_URL_FRAGMENT_PARAMS: string[];
+export declare const cleanUrl: (href: string, mode: UrlMode) => string;
+export declare const cleanPageHref: () => string;

package/dist/types/src/pageViewTracker.d.ts

@@ -3,6 +3,8 @@ import { BaseEvent } from './sdkRuntimeModels';
 import { Dictionary } from './utils';
 export declare const WIN_APV_KEY = "__mpApv__";
 export declare const ALLOWED_QUERY_PARAMS: string[];
+export declare const ALLOWED_QUERY_PARAM_PREFIXES: string[];
+export declare const isAllowedQueryParam: (name: string) => boolean;
 interface IPageSnapshot {
     path: string;
     params: Dictionary<string>;

package/dist/types/src/roktManager.d.ts

@@ -5,6 +5,7 @@ import { Dictionary, AttributeValue } from "./utils";
 import { SDKIdentityApi } from "./identity.interfaces";
 import { SDKLoggerApi } from "./sdkRuntimeModels";
 import { IStore, LocalSessionAttributes } from "./store";
+import { MPID } from "@mparticle/web-sdk";
 import { IErrorReportingService, ILoggingService } from "./reporting/types";
 import { IRoktLauncherOptions } from "./roktLauncherOptions";
 import IntegrationCapture from "./integrationCapture";
@@ -82,6 +83,7 @@ export default class RoktManager {
     kit: IRoktKit;
     filters: RoktKitFilterSettings;
     private currentUser;
+    private createFilteredUser?;
     private messageQueue;
     private sandbox;
     private placementAttributesMapping;
@@ -116,10 +118,11 @@ export default class RoktManager {
      * @param {Function} captureTiming - Function to capture performance timing marks
      * @param {IErrorReportingService} errorReporter - Dispatcher for error/warning reporting
      * @param {ILoggingService} loggingService - Dispatcher for informational logging
+     * @param {Function} createFilteredUser - Builds a user as the Rokt connection's filters and the data plan allow
      *
      * @throws Logs error to console if placementAttributesMapping parsing fails
      */
-    init(roktConfig: IKitConfigs, filteredUser: IMParticleUser, identityService: SDKIdentityApi, store: IStore, logger?: SDKLoggerApi, options?: IRoktOptions, captureTiming?: (metricsName: string) => void, errorReporter?: IErrorReportingService, loggingService?: ILoggingService, integrationCapture?: IntegrationCapture): void;
+    init(roktConfig: IKitConfigs, filteredUser: IMParticleUser, identityService: SDKIdentityApi, store: IStore, logger?: SDKLoggerApi, options?: IRoktOptions, captureTiming?: (metricsName: string) => void, errorReporter?: IErrorReportingService, loggingService?: ILoggingService, integrationCapture?: IntegrationCapture, createFilteredUser?: (mpid: MPID) => IMParticleUser): void;
     get isInitialized(): boolean;
     attachKit(kit: IRoktKit): void;
     private watchRouteChanges;
@@ -146,6 +149,7 @@ export default class RoktManager {
      * });
      */
     selectPlacements(options: IRoktSelectPlacementsOptions): Promise<IRoktSelection>;
+    private logFilteredIdentity;
     /**
      * Hashes attributes and returns both original and hashed versions
      * with Rokt-compatible key names (like emailsha256, mobilesha256)

package/dist/types/src/sdkRuntimeModels.d.ts

@@ -19,6 +19,7 @@ import { IErrorLogMessage, IMParticleWebSDKInstance, IntegrationDelays } from '.
 import Constants from './constants';
 import RoktManager, { IRoktLauncherOptions } from './roktManager';
 import { IConsoleLogger } from './logger';
+import { UrlMode } from './pageUrl';
 import { ErrorCodes, IErrorReportingService, ILoggingService } from './reporting/types';
 export type SDKEventCustomFlags = Dictionary<any>;
 export interface SDKEvent {
@@ -194,6 +195,7 @@ export interface IMParticleInstanceManager extends MParticleWebSDK {
     _instances: Dictionary<IMParticleWebSDKInstance>;
     _isTestEnv?: boolean;
     _forceNoLocalStorage?: boolean;
+    _cleanUrl(href: string, mode: UrlMode): string;
     config: SDKInitConfig;
     isIOS?: boolean;
     MPSideloadedKit: typeof MPSideloadedKit;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mparticle/web-sdk",
-    "version": "3.22.0",
+    "version": "3.23.0",
     "description": "mParticle core SDK for web applications",
     "license": "Apache-2.0",
     "keywords": [

package/src/batchUploader.ts

@@ -3,7 +3,8 @@ import Constants from './constants';
 import { SDKEvent, SDKEventCustomFlags } from './sdkRuntimeModels';
 import { convertEvents } from './sdkToEventsApiConverter';
 import { MessageType, EventType } from './types';
-import { getRampNumber, getHref, isEmpty, obfuscateDevData } from './utils';
+import { getRampNumber, isEmpty, obfuscateDevData } from './utils';
+import { cleanPageHref } from './pageUrl';
 import { SessionStorageVault, LocalStorageVault, StorageResult } from './vault';
 import {
     AsyncUploader,
@@ -204,7 +205,7 @@ export class BatchUploader {
             Debug: SDKConfig.isDevelopmentMode,
             ActiveTimeOnSite: _timeOnSiteTimer?.getTimeInForeground() || 0,
             TotalTimeOnSite: _Store.getTotalTimeOnSite?.() || 0,
-            PageUrl: getHref() || null,
+            PageUrl: cleanPageHref() || null,
             IsBackgroundAST: true
         } as SDKEvent;
 

package/src/mp-instance.ts

@@ -45,7 +45,7 @@ import { removeExpiredIdentityCacheDates, hasExplicitIdentifier } from './identi
 import IntegrationCapture, { isIntegrationCaptureEnabled } from './integrationCapture';
 import { IPreInit, processReadyQueue } from './pre-init-utils';
 import { BaseEvent, MParticleWebSDK, SDKHelpersApi } from './sdkRuntimeModels';
-import { Dictionary, SDKEventAttrs } from '@mparticle/web-sdk';
+import { Dictionary, MPID, SDKEventAttrs } from '@mparticle/web-sdk';
 import { IIdentity } from './identity.interfaces';
 import { IEvents } from './events.interfaces';
 import { IECommerce } from './ecommerce.interfaces';
@@ -1424,12 +1424,8 @@ function completeSDKInitialization(apiKey, config, mpInstance) {
         if (roktConfig) {
             const accountId = roktConfig.settings?.accountId;
             mpInstance._Store.setRoktAccountId(accountId);
-            const { userAttributeFilters } = roktConfig;
-            const roktFilteredUser = filteredMparticleUser(
-                currentUserMPID,
-                { userAttributeFilters },
-                mpInstance
-            );
+            const createRoktFilteredUser = (mpid: MPID) =>
+                filteredMparticleUser(mpid, roktConfig, mpInstance, kitBlocker);
             const roktOptions: IRoktOptions = {
                 sandbox: config?.isDevelopmentMode,
                 launcherOptions: config?.launcherOptions,
@@ -1438,7 +1434,7 @@ function completeSDKInitialization(apiKey, config, mpInstance) {
             // https://go.mparticle.com/work/SQDSDKS-7339
             mpInstance._RoktManager.init(
                 roktConfig,
-                roktFilteredUser,
+                createRoktFilteredUser(currentUserMPID),
                 mpInstance.Identity,
                 mpInstance._Store,
                 mpInstance.Logger,
@@ -1447,6 +1443,7 @@ function completeSDKInitialization(apiKey, config, mpInstance) {
                 mpInstance._ErrorReportingDispatcher,
                 mpInstance._LoggingDispatcher,
                 mpInstance._IntegrationCapture,
+                createRoktFilteredUser,
             );
         }
 

package/src/mparticle-instance-manager.ts

@@ -7,6 +7,7 @@ import MPSideloadedKit from './sideloadedKit';
 import { IMParticleInstanceManager } from './sdkRuntimeModels';
 import { IStore } from './store';
 import { Dictionary } from '@mparticle/web-sdk';
+import { cleanUrl } from './pageUrl';
 
 if (!Array.prototype.forEach) {
     Array.prototype.forEach = Polyfill.forEach;
@@ -449,6 +450,8 @@ function mParticleInstanceManager(this: IMParticleInstanceManager) {
     this.generateHash = function(string) {
         return self.getInstance().generateHash(string);
     };
+    // Kits clean every URL they send with the same rule as core events.
+    this._cleanUrl = cleanUrl;
     this.addForwarder = function(forwarder) {
         self.getInstance().addForwarder(forwarder);
     };

package/src/pageUrl.ts

@@ -0,0 +1,150 @@
+import { isAllowedQueryParam } from './pageViewTracker';
+import { getHref, valueof } from './utils';
+
+// The one rule for a URL that leaves the SDK, shared with kits through
+// `mParticle._cleanUrl`. `path` keeps scheme, host and path. `full` adds the
+// query params an auto page view may capture, then the fragment.
+export const UrlMode = {
+    Path: 'path',
+    Full: 'full',
+} as const;
+
+export type UrlMode = valueof<typeof UrlMode>;
+
+// OAuth 2.0 / OIDC authorization-flow params. They stay off URLs even where the
+// page view allowlist admits them, because a URL travels on every event.
+export const EXCLUDED_URL_QUERY_PARAMS: string[] = [
+    'client_id',
+    'redirect_uri',
+    'response_type',
+    'scope',
+    'state',
+    'code',
+    'nonce',
+];
+
+// An OAuth implicit or OIDC fragment response puts its tokens in `#k=v&...`.
+export const EXCLUDED_URL_FRAGMENT_PARAMS: string[] = EXCLUDED_URL_QUERY_PARAMS.concat(
+    [
+        'access_token',
+        'id_token',
+        'refresh_token',
+        'provider_token',
+        'provider_refresh_token',
+    ]
+);
+
+// Allowlisted params whose value is itself a URL, so it can carry a query.
+const URL_VALUED_QUERY_PARAMS: string[] = ['ref', 'referrer'];
+
+const USERINFO = /^((?:[a-z][a-z0-9+.-]*:)?\/\/)[^/]*@/i;
+
+const decodeQueryComponent = (component: string): string =>
+    decodeURIComponent(component.replace(/\+/g, ' '));
+
+const cleanQueryPair = (pair: string): string | null => {
+    const separator = pair.indexOf('=');
+    const rawName = separator === -1 ? pair : pair.slice(0, separator);
+    let name: string;
+    try {
+        name = decodeQueryComponent(rawName);
+    } catch (e) {
+        return null;
+    }
+
+    const lowerName = name.toLowerCase();
+    if (
+        !name ||
+        !isAllowedQueryParam(name) ||
+        EXCLUDED_URL_QUERY_PARAMS.indexOf(lowerName) !== -1
+    ) {
+        return null;
+    }
+
+    if (separator === -1 || URL_VALUED_QUERY_PARAMS.indexOf(lowerName) === -1) {
+        return pair;
+    }
+
+    let value: string;
+    try {
+        value = decodeQueryComponent(pair.slice(separator + 1));
+    } catch (e) {
+        return null;
+    }
+    const cleanedValue = cleanUrl(value, UrlMode.Path);
+    return cleanedValue === value
+        ? pair
+        : `${rawName}=${encodeURIComponent(cleanedValue)}`;
+};
+
+const cleanQuery = (query: string): string =>
+    query
+        .split('&')
+        .map(cleanQueryPair)
+        .filter((pair): pair is string => pair !== null)
+        .join('&');
+
+const keepsFragmentPair = (pair: string): boolean => {
+    try {
+        const name = decodeQueryComponent(pair.split('=')[0]);
+        return EXCLUDED_URL_FRAGMENT_PARAMS.indexOf(name.toLowerCase()) === -1;
+    } catch (e) {
+        return false;
+    }
+};
+
+// A hash route (`#/...`, `#!...`, or a path with no `=` before its `?`) keeps
+// its path; a query inside it gets the same allowlist as the URL's own query.
+// A fragment of bare pairs loses the OAuth/OIDC ones.
+const cleanFragment = (hash: string): string => {
+    const queryStart = hash.indexOf('?');
+    const route = queryStart === -1 ? hash : hash.slice(0, queryStart);
+    const isRoute =
+        /^#[/!]/.test(hash) || (queryStart !== -1 && route.indexOf('=') === -1);
+
+    if (isRoute && queryStart !== -1) {
+        const query = cleanQuery(hash.slice(queryStart + 1));
+        return route + (query ? `?${query}` : '');
+    }
+
+    if (hash.indexOf('=') === -1) {
+        return hash;
+    }
+
+    const pairs = hash
+        .slice(1)
+        .split('&')
+        .filter(keepsFragmentPair)
+        .join('&');
+    return pairs ? `#${pairs}` : '';
+};
+
+// String-based rather than `new URL`, so kept pairs and the fragment go out
+// exactly as the browser reported them and no environment can parse differently.
+// An unknown mode is treated as `path`.
+export const cleanUrl = (href: string, mode: UrlMode): string => {
+    if (typeof href !== 'string' || !href) {
+        return '';
+    }
+
+    const hashStart = href.indexOf('#');
+    const hash = hashStart === -1 ? '' : href.slice(hashStart);
+    const beforeHash = hashStart === -1 ? href : href.slice(0, hashStart);
+    const queryStart = beforeHash.indexOf('?');
+    const path = (queryStart === -1
+        ? beforeHash
+        : beforeHash.slice(0, queryStart)
+    ).replace(USERINFO, '$1');
+
+    if (mode !== UrlMode.Full) {
+        return path;
+    }
+
+    const query =
+        queryStart === -1 ? '' : cleanQuery(beforeHash.slice(queryStart + 1));
+
+    return path + (query ? `?${query}` : '') + cleanFragment(hash);
+};
+
+// The current page as it may appear on an event.
+export const cleanPageHref = (): string => cleanUrl(getHref(), UrlMode.Full);

package/src/pageViewTracker.ts

@@ -55,6 +55,12 @@ export const ALLOWED_QUERY_PARAMS: string[] = [
     'utm_term',
     'utm_content',
     'utm_id',
+    'utm_source_platform',
+    'utm_creative_format',
+    'utm_marketing_tactic',
+    'gad_source',
+    'gad_campaignid',
+    'mc_cid',
 
     // Ad-network click ids
     'gclid',
@@ -66,6 +72,12 @@ export const ALLOWED_QUERY_PARAMS: string[] = [
     'twclid',
     'li_fat_id',
     'dclid',
+    'srsltid',
+    'epik',
+    'ScCid',
+    'irclickid',
+    'rtid',
+    'rclid',
 
     // OAuth / OIDC — see the SECURITY note above
     'client_id',
@@ -120,6 +132,27 @@ export const ALLOWED_QUERY_PARAMS: string[] = [
     'referrer',
 ];
 
+// Params matched by name prefix, for platforms that put a per-product id in the
+// name. Salesforce Commerce Cloud spells a variant choice
+// `dwvar_<productId>_<attribute>`, e.g. `dwvar_12345_color=navy`.
+export const ALLOWED_QUERY_PARAM_PREFIXES: string[] = ['dwvar_'];
+
+const hasAllowedPrefix = (name: string): boolean =>
+    ALLOWED_QUERY_PARAM_PREFIXES.some(prefix => name.indexOf(prefix) === 0);
+
+const ALLOWED_QUERY_PARAMS_LOWER: string[] = ALLOWED_QUERY_PARAMS.map(name =>
+    name.toLowerCase()
+);
+
+// Whether a query param name, in any case, is one an auto page view captures.
+export const isAllowedQueryParam = (name: string): boolean => {
+    const lower = name.toLowerCase();
+    return (
+        ALLOWED_QUERY_PARAMS_LOWER.indexOf(lower) !== -1 ||
+        hasAllowedPrefix(lower)
+    );
+};
+
 interface IPageSnapshot {
     path: string;
     params: Dictionary<string>;
@@ -152,8 +185,18 @@ interface IPendingNavigation {
 // attribute), drops empty values, and carries the fallback for browsers without
 // URLSearchParams. Tolerates an empty href, so SSR yields no params rather than
 // throwing.
-export const allowedQueryParams = (href: string): Dictionary<string> =>
-    queryStringParser(href, ALLOWED_QUERY_PARAMS);
+export const allowedQueryParams = (href: string): Dictionary<string> => {
+    const params = queryStringParser(href, ALLOWED_QUERY_PARAMS);
+    const allParams = queryStringParser(href);
+
+    Object.keys(allParams)
+        .filter(name => hasAllowedPrefix(name) && allParams[name])
+        .forEach(name => {
+            params[name] = allParams[name];
+        });
+
+    return params;
+};
 
 export const AUTO_PAGE_VIEW_ATTRIBUTE = 'is_auto_page_view';
 
@@ -165,10 +208,9 @@ export const autoPageViewAttribute = (
 ): Dictionary<boolean> =>
     isAutoPageView ? { [AUTO_PAGE_VIEW_ATTRIBUTE]: true } : {};
 
-// The captured params, in allowlist order. Ordering comes from the constant
-// rather than a sort: it is deterministic without needing a comparator, and it
-// does not depend on the object's insertion order, so reordering the query string
-// cannot produce a different key.
+// The captured params, in allowlist order, then prefix-matched names sorted.
+// Neither depends on the object's insertion order, so reordering the query
+// string cannot produce a different key.
 //
 // Membership is an own-property check, not `in`. `in` walks the prototype
 // chain, so a name matching an Object.prototype member reports as present on
@@ -176,7 +218,11 @@ export const autoPageViewAttribute = (
 // only thing making `in` safe here — and it stops being a safe assumption the
 // moment this list can be extended from configuration.
 const capturedNames = (params: Dictionary<string>): string[] =>
-    ALLOWED_QUERY_PARAMS.filter(name => hasOwnProp(params, name));
+    ALLOWED_QUERY_PARAMS.filter(name => hasOwnProp(params, name)).concat(
+        Object.keys(params)
+            .filter(hasAllowedPrefix)
+            .sort()
+    );
 
 // The dedup key: pathname plus the allowlisted params in a fixed order, so that
 // reordering the query string is not a new page. Params outside the allowlist

package/src/roktManager.ts

@@ -15,7 +15,7 @@ import {
 import { SDKIdentityApi } from "./identity.interfaces";
 import { SDKLoggerApi } from "./sdkRuntimeModels";
 import { IStore, LocalSessionAttributes } from "./store";
-import { UserIdentities } from "@mparticle/web-sdk";
+import { MPID, UserIdentities } from "@mparticle/web-sdk";
 import { IdentityType, PerformanceMarkType } from "./types";
 import { ErrorCodes, IErrorReportingService, ILoggingService, WSDKErrorSeverity } from "./reporting/types";
 import { IRoktLauncherOptions, normalizeRoktLauncherOptions } from "./roktLauncherOptions";
@@ -136,6 +136,7 @@ export default class RoktManager {
     public kit: IRoktKit = null;
     public filters: RoktKitFilterSettings = {};
     private currentUser: IMParticleUser | null = null;
+    private createFilteredUser?: (mpid: MPID) => IMParticleUser;
     private messageQueue: Map<string, IRoktMessage> = new Map();
     private sandbox: boolean | null = null;
     private placementAttributesMapping: Dictionary<string>[] = [];
@@ -178,6 +179,7 @@ export default class RoktManager {
      * @param {Function} captureTiming - Function to capture performance timing marks
      * @param {IErrorReportingService} errorReporter - Dispatcher for error/warning reporting
      * @param {ILoggingService} loggingService - Dispatcher for informational logging
+     * @param {Function} createFilteredUser - Builds a user as the Rokt connection's filters and the data plan allow
      *
      * @throws Logs error to console if placementAttributesMapping parsing fails
      */
@@ -192,6 +194,7 @@ export default class RoktManager {
         errorReporter?: IErrorReportingService,
         loggingService?: ILoggingService,
         integrationCapture?: IntegrationCapture,
+        createFilteredUser?: (mpid: MPID) => IMParticleUser,
     ): void {
         const { userAttributeFilters, settings } = roktConfig || {};
         const { placementAttributesMapping, hashedEmailUserIdentityType } = settings || {};
@@ -204,6 +207,7 @@ export default class RoktManager {
         this.loggingService = loggingService;
         this.captureTiming = captureTiming;
         this.integrationCapture = integrationCapture;
+        this.createFilteredUser = createFilteredUser;
 
         this.captureTiming?.(PerformanceMarkType.JointSdkRoktKitInit);
 
@@ -504,11 +508,13 @@ export default class RoktManager {
                 }
             }
 
-            // Optimistic merge: apply the pending identity changes locally so
-            // enrichedAttributes are correct without waiting for the identify round-trip.
-            // The next call to selectPlacements re-fetches currentUser (see line above),
-            // so stale identity state does not persist beyond this invocation.
-            const finalUserIdentities = { ...currentUserIdentities, ...newIdentities };
+            // The identify above needs every identity, so currentUserIdentities stays unfiltered.
+            // Without createFilteredUser the connection's filters cannot be applied, so no identity is added.
+            const roktUser =
+                this.currentUser && this.createFilteredUser
+                    ? this.createFilteredUser(this.currentUser.getMPID())
+                    : null;
+            const roktUserIdentities = roktUser?.getUserIdentities()?.userIdentities || {};
 
             const timeOnSite = this.store?.getTimeOnSite?.();
             const totalTimeOnSite = this.store?.getTotalTimeOnSite?.();
@@ -521,19 +527,25 @@ export default class RoktManager {
             };
 
             // Propagate email from current user identities if not already in attributes
-            if (finalUserIdentities.email && !enrichedAttributes.email) {
-                enrichedAttributes.email = finalUserIdentities.email;
+            if (!enrichedAttributes.email) {
+                if (roktUserIdentities.email) {
+                    enrichedAttributes.email = roktUserIdentities.email;
+                } else if (currentUserIdentities.email) {
+                    this.logFilteredIdentity('email');
+                }
             }
 
             // Propagate emailsha256 from current user identities if not already in attributes
-            if (isValidHashedEmailIdentityType) {
-                const hashedEmail = finalUserIdentities[this.mappedEmailShaIdentityType];
-                if (
-                    hashedEmail &&
-                    !enrichedAttributes.emailsha256 &&
-                    !enrichedAttributes[this.mappedEmailShaIdentityType]
-                ) {
+            if (
+                isValidHashedEmailIdentityType &&
+                !enrichedAttributes.emailsha256 &&
+                !enrichedAttributes[this.mappedEmailShaIdentityType]
+            ) {
+                const hashedEmail = roktUserIdentities[this.mappedEmailShaIdentityType];
+                if (hashedEmail) {
                     enrichedAttributes.emailsha256 = hashedEmail;
+                } else if (currentUserIdentities[this.mappedEmailShaIdentityType]) {
+                    this.logFilteredIdentity(this.mappedEmailShaIdentityType);
                 }
             }
 
@@ -546,7 +558,7 @@ export default class RoktManager {
                 }
             }
 
-            this.filters.filteredUser = this.currentUser || this.filters.filteredUser || null;
+            this.filters.filteredUser = roktUser || this.filters.filteredUser || null;
 
             const enrichedOptions = {
                 ...options,
@@ -559,6 +571,12 @@ export default class RoktManager {
         }
     }
 
+    private logFilteredIdentity(identityType: string): void {
+        this.logger?.verbose(
+            `mParticle.Rokt selectPlacements did not add the ${identityType} user identity to the attributes because the Rokt connection does not allow it`
+        );
+    }
+
     /**
      * Hashes attributes and returns both original and hashed versions
      * with Rokt-compatible key names (like emailsha256, mobilesha256)

package/src/sdkRuntimeModels.ts

@@ -53,6 +53,7 @@ import {
 import Constants from './constants';
 import RoktManager, { IRoktLauncherOptions } from './roktManager';
 import { IConsoleLogger } from './logger';
+import { UrlMode } from './pageUrl';
 import { ErrorCodes, IErrorReportingService, ILoggingService } from './reporting/types';
 
 // TODO: Resolve this with version in @mparticle/web-sdk
@@ -282,6 +283,7 @@ export interface IMParticleInstanceManager extends MParticleWebSDK {
     _instances: Dictionary<IMParticleWebSDKInstance>;
     _isTestEnv?: boolean;
     _forceNoLocalStorage?: boolean;
+    _cleanUrl(href: string, mode: UrlMode): string;
 
     // Public Properties
     config: SDKInitConfig;

package/src/serverModel.ts

@@ -17,8 +17,8 @@ import {
     Dictionary,
     isValidCustomFlagProperty,
     extend,
-    getHref,
 } from './utils';
+import { cleanPageHref } from './pageUrl';
 import { IntegrationAttributes, ServerSettings } from './store';
 import { MPID } from '@mparticle/web-sdk';
 import {
@@ -310,7 +310,7 @@ export default function ServerModel(
                     ),
                     ActiveTimeOnSite: mpInstance._timeOnSiteTimer?.getTimeInForeground(),
                     TotalTimeOnSite: mpInstance._Store.getTotalTimeOnSite?.(),
-                    PageUrl: getHref() || null,
+                    PageUrl: cleanPageHref() || null,
                     SourceMessageId:
                         event.sourceMessageId ||
                         mpInstance._Helpers.generateUniqueId(),
@@ -352,7 +352,7 @@ export default function ServerModel(
 
             if (eventObject.EventDataType === MessageType.AppStateTransition) {
                 eventObject.IsFirstRun = mpInstance._Store.isFirstRun;
-                eventObject.LaunchReferral = window.location.href || null;
+                eventObject.LaunchReferral = cleanPageHref() || null;
             }
 
             // FIXME: Remove duplicate occurence

package/src/utils.ts

@@ -385,7 +385,7 @@ interface URLSearchParamsFallback {
 
 const queryStringParserFallback = (url: string): URLSearchParamsFallback => {
     const params: Dictionary<string> = {};
-    const queryString = url.split('?')[1] || '';
+    const queryString = url.split('#')[0].split('?')[1] || '';
     const pairs = queryString.split('&');
 
     pairs.forEach(pair => {