Safe to have space in hash/URL fragment?

Question

I'm writing a Javascript driven one-page application where the URL contains a # param eg. (example.com/#foo/bar) to represent application state (I've considered using various JS frameworks but cannot, due to various reasons).

Sometimes, the hash may have a space (or many spaces) in it. Eg. example.com/#foo/bar bar2.

1. Is this safe?
2. Are there any other characters that shouldn't be used in the hash portion?

This question addresses the question of spaces in the URL portion and recommends escaping spaces. But since changing the fragment after the # doesn't result in a new HTTP request, do those rules apply?

Answer 1

I'm going to sidestep the question of what is safe and simply state that whitespace in the URL is illegal per section 2.4.3 of RFC 2396. Doing illegal things means that you cannot really predict what software will do when it encounters such a URI.

Besides, if JavaScript is involved you probably don't want to guarantee that changing that hash of a URL doesn't trigger an XHR and cause network activity that re-parses the URL. (For example, you may decide you want to mess with history state or do some analytical tracking onhashchange.)