TYPO3 Core

For every link, an id parameter is provided, even for the links to the root page. The root page also has an uid, right?

I think this is only an issue in combination with realurl because realurl strips the ID parameter on the rootpage and therefore
\TYPO3\CMS\Frontend\Controller\TypoScriptFrontendController::fetch_the_id will determine the ID by using e.g. using the domainStartPage but that method will not set the corresponding $_GET['id'] parameter.

I think it actually should also be set here as the page ID has been determined by the core (even if it wasn't in the URL) but was not added to the GET-parameters afterwards to have a correct cHash verification.
But I think it is more a realurl bug as realurl removed the ID parameter from the corresponding link and should therefore ensure it is added correctly again.

'id' parameter is not required by TYPO3. If the 'id' parameter is not given, TYPO3 always uses the root page id for the current domain. It should do so in any case, with realurl or without. Nothing illegal in having http://example.com/?tx_myext[uid]=5&cHash=whtever.

The problem is inside makeCacheHash, it uses $_GET. The fix is quite simple. I am going to make a pull request.

Patch set 1 for branch TYPO3_7-6 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50198