Auth State mismatch. URL Double Encoding

[kucjac]

Hi
We're using your full stack with latest versions. (hydra version: 'v1.0.0-beta.8')
On the front end we're using Nuxt.js with Nuxt-Auth authorization library.
Nuxt-Auth parses the state base64 encoded.
While pushing the state to hydra auth endpoint, the state is encoded two times.

Example:
Nuxt sends the state: MC45MTYzODAxNjA3Mjc0MTY=
It comes back from hydra after correct login in a form: MC45MTYzODAxNjA3Mjc0MTY%253D

It looks like the initial value is being url.QueryEncoded into MC45MTYzODAxNjA3Mjc0MTY%3D and then again the '%' sign is being encoded into the form provided above.

The consent app is a simple golang consent using your newest sdk, and on our backend we don't change the state value.

It crashes the auth flow when the state ends up with '='.

[aeneasr]

Looks like a bug, although = isn't url safe it probably shouldn't be double encoded. It's also allowed per spec in the state iirc.

[aeneasr]

Actually, I can not reproduce this. I tried it with &state=rflvvkpeldfzfdzyoocqihxh%3D%3D and &state=rflvvkpeldfzfdzyoocqihxh== in the browser url. The first time the state comes back with &state=rflvvkpeldfzfdzyoocqihxh%3D%3D and also the second time &state=rflvvkpeldfzfdzyoocqihxh%3D%3D. I also checked the code and there is no double encoding. Are you sure this isn't on your side (client code)?

[aeneasr]

Closing, feel free to comment/reopen you found the issue