Double URI encoding on additionnalState

Hi,

I’m working on a multi tenant application and I send the tenant value through the additionnalState param of the initImplicitFlow() function.

Example :

this.oauthService.initImplicitFlow('tenant=test');

The url generated for the redirection looks like : https:…&state=…%3Btenant%253Dtest&… It’s like the ‘=’ is encoded twice : encodeURIComponent(encodeURIComponent('tenant=test'))

Clue By looking at the code, I found that the additionnalState is encoded at line 1378 and 1415 of createLoginUrl() in OAuthService.ts

state = nonce + this.config.nonceStateSeparator + encodeURIComponent(state);

 let url =
      that.loginUrl +
      seperationChar +
      'response_type=' +
      encodeURIComponent(that.responseType) +
      '&client_id=' +
      encodeURIComponent(that.clientId) +
      '&state=' +
      encodeURIComponent(state) +
      '&redirect_uri=' +
      encodeURIComponent(redirectUri) +
      '&scope=' +
      encodeURIComponent(scope);

[amortemousque]

Hello, yes very strange. I double check and I do not encode the state before calling initImplicitFlow(). I upgraded to the latest version and I got the same issue, so I’ve downgraded to the version 8.0.2 and now it’s working. Looking at the code of version 8.0.2, the state is already encoded on line https://github.com/manfredsteyer/angular-oauth2-oidc/blob/a1652dc58e38377ce1e352feafb9656136e98fa0/projects/lib/src/oauth-service.ts#L1225

I’ll create a minimal repo when I have more time.

[jeroenheijmans]

I believe v12 has a couple of changes also around this. Since the issue slowed down quite a bit I’m gonna close. Please open a fresh issue with a reproducible scenario for v12 if it persists.