I have a URL like this:

When I used Istio AuthorizationPolicy to denied the path include #, it won't be work.

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: test
spec:
  action: DENY
  rules:
  - to:
    - operation:
        paths: ["/test1/#/test2"] # not work

When I removed #, istio can successfully block website. But other path will be blocked also.

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: test
spec:
  action: DENY
  rules:
  - to:
    - operation:
        paths: ["/test1/*"] # works, but others path be blocked also

How can I block website when path include # () ?