Skip to content

OAuth2: encode redirect_uri when building the authorization request

username-removed-10562 requested to merge encode-redirect into master

According to https://tools.ietf.org/html/rfc6749#section-4.1.1, the parameters used to construct the authorization request URI need all to be escaped using the "application/x-www-form-urlencoded" format. Prior to this commit, we were not encoding them at all.

With this commit, we encode only the redirect_uri and the scope parameters: we assume that other parameters won't contain forbidden characters.

Merge request reports