setting location.hash = '' in FireFox can cause router race conditions

[cgatian]

Describe the bug
The Angular Router can get into a infinite loop in Firefox when Router.navigateByUrl is invoked and the token from the IdP contains an error.
I believe others are not seeing this issue in the masses because it requires the IdP redirection location to first land on an "confirmation page", this page then redirects the app to the proper application route, based on success or failure. When failure occurs the window.location contains a hash in the URL. Which causes the Angular router to invoke popstate immediately after the navigateByUrl routing has completed.

What is Occurring:

1. Angular Application bootstraps and tryLogin is invoked on app.component
2. Token is parsed by oauth2 lib, and it contains an error handleLoginError is invoked
3. Within this method an attempt is made to clear location.hash if configured and set location.hash = '' (code)
4. In Firefox only! location.hash = '' will actually add hash to the URL!
   
5. Error bubbles out from oauth2 lib and app.component calls Router.navigateByUrl
6. Routing successful
7. popstate occurs in Angular router redirecting the app back to app.component
8. tryLogin is again attempted by app.component; process repeats (GOTO step 2)

---

Expected behavior
No infinite routing loops 😄

Additional context
Firefox adds a hash to the URL if you attempt to clear it with an empty string. This can be fixed by first checking if location.hash contains a hash before trying to clear it with an empty string.

I believe fixing this would address other issues that have workarounds:
#493
#408

This issue also describes the problems using location.hash and Angular Router
#622

[rinella]

I was running into continuous redirection / race conditions in firefox and I found that setting the configuration to clearHashAfterLogin = false solved the problem. the hash removal was causing it to redirect back to login. /login#token -> /home -> /login

I also use an intermediary page (/login) to receive the token and then route accordingly. I use this strategy because I have auth guards.

hope this helps someone.

[cgatian]

@rinella thats also what I am doing (as a workaround). There's issues with Angular apps that use hashed based routing. I wish the PR would just be merged :)