Showing results for 
Search instead for 
Did you mean: 

Oauth State parameter with special character being altered

I am working on adding Oauth support to my API integration.  My existing system has logic in place to use the "state" parameter both to validate and redirect users to the necessary page after requesting the initial token.  I am looking to reuse this method that works for several other of our Oauth integrations and as such it's not simple to change.  In testing's oauth, special characters seem to be getting stripped out from the state param, notably the "^" character.  I have tested encoding and escaping it in the URL in different ways but this seems to either have no effect or causes an error.


As an example, we are redirecting the user to:

(note the param "state=stateInfo1^stateInfo2")

but at the end they get redirected back to

(note the param "state=stateInfo1stateInfo2")


Note the state param is missing the "^" between "stateInfo1" and "stateInfo2".  We have tried passing the ^ as shown as well as URL encoding it to %5E, escaping it with slashes, etc.  I tested passing state=stateInfo1%20stateInfo2, and in the redirect back to us the state param was "state=stateInfo1 stateInfo2" with the space, but %5E just gets removed as shown above.



Is there a way to get the Redirect URI to be followed and keep the state param value unchanged?