{"action":"created","issue":{"url":"https://api.github.com/repos/FriendsOfSymfony/FOSOAuthServerBundle/issues/460","repository_url":"https://api.github.com/repos/FriendsOfSymfony/FOSOAuthServerBundle","labels_url":"https://api.github.com/repos/FriendsOfSymfony/FOSOAuthServerBundle/issues/460/labels{/name}","comments_url":"https://api.github.com/repos/FriendsOfSymfony/FOSOAuthServerBundle/issues/460/comments","events_url":"https://api.github.com/repos/FriendsOfSymfony/FOSOAuthServerBundle/issues/460/events","html_url":"https://github.com/FriendsOfSymfony/FOSOAuthServerBundle/issues/460","id":221868008,"number":460,"title":"URL Encoding issue in redirect_url check","user":{"login":"netmikey","id":1180845,"avatar_url":"https://avatars3.githubusercontent.com/u/1180845?v=3","gravatar_id":"","url":"https://api.github.com/users/netmikey","html_url":"https://github.com/netmikey","followers_url":"https://api.github.com/users/netmikey/followers","following_url":"https://api.github.com/users/netmikey/following{/other_user}","gists_url":"https://api.github.com/users/netmikey/gists{/gist_id}","starred_url":"https://api.github.com/users/netmikey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/netmikey/subscriptions","organizations_url":"https://api.github.com/users/netmikey/orgs","repos_url":"https://api.github.com/users/netmikey/repos","events_url":"https://api.github.com/users/netmikey/events{/privacy}","received_events_url":"https://api.github.com/users/netmikey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-04-14T18:51:43Z","updated_at":"2017-04-16T09:26:04Z","closed_at":null,"body":"I am trying to use a `redirect_url` that contains query parameters with the Authorization Code Grant flow. The redirects in the browser succeed, here is what chrome is requesting:\r\n\r\n    http://127.0.0.1:8080/app_dev.php/oauth/v2/auth?client_id=39691&response_type=code&redirect_uri=http://127.0.0.1:8091/authResponse?continue%3Dhttp://localhost:4200/assets/oauth.html%26client_id%3D39691\r\n\r\nSo the value of `redirect_uri` is `http://127.0.0.1:8091/authResponse?continue%3Dhttp://localhost:4200/assets/oauth.html%26client_id%3D39691`.\r\n\r\nWhat ends up in the oauth_auth_code storage however is the value `http://127.0.0.1:8091/authResponse?continue=http://localhost:4200/assets/oauth.html&client_id=39691` -- note that this URL seems to have been url-decoded before storage.\r\n\r\nNow, when my oauth client calls the `/oauth/v2/token` endpoint to retrieve a token from the code obtained above, the `redirect_url` comparison fails because the incoming URL is not url-decoded. Here is the part that fails: https://github.com/FriendsOfSymfony/oauth2-php/blob/master/lib/OAuth2.php#L892-L898\r\nI extended the error message to include both: `$input[\"redirect_uri\"]` and `$authCode->getRedirectUri()`, and here is what it says:\r\n\r\n    {\"error\":\"redirect_uri_mismatch\",\"error_description\":\"The redirect URI is missing or do not match. Input: http://127.0.0.1:8091/authResponse?continue%3Dhttp://localhost:4200/assets/oauth.html%26client_id%3D39691 / Stored: http://127.0.0.1:8091/authResponse?continue=http://localhost:4200/assets/oauth.html&client_id=39691\"}\r\n\r\nThe solution would be to either store redirect URIs in their encoded form in the `/oauth/v2/auth` endpoint, or to url-decode the incoming `redirect_uri` in the `/oauth/v2/token` endpoint.\r\n\r\nAs it stands now, it looks like having query parameters in a `redirect_uri` doesn't work."},"comment":{"url":"https://api.github.com/repos/FriendsOfSymfony/FOSOAuthServerBundle/issues/comments/294342327","html_url":"https://github.com/FriendsOfSymfony/FOSOAuthServerBundle/issues/460#issuecomment-294342327","issue_url":"https://api.github.com/repos/FriendsOfSymfony/FOSOAuthServerBundle/issues/460","id":294342327,"user":{"login":"Spomky","id":1091072,"avatar_url":"https://avatars1.githubusercontent.com/u/1091072?v=3","gravatar_id":"","url":"https://api.github.com/users/Spomky","html_url":"https://github.com/Spomky","followers_url":"https://api.github.com/users/Spomky/followers","following_url":"https://api.github.com/users/Spomky/following{/other_user}","gists_url":"https://api.github.com/users/Spomky/gists{/gist_id}","starred_url":"https://api.github.com/users/Spomky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Spomky/subscriptions","organizations_url":"https://api.github.com/users/Spomky/orgs","repos_url":"https://api.github.com/users/Spomky/repos","events_url":"https://api.github.com/users/Spomky/events{/privacy}","received_events_url":"https://api.github.com/users/Spomky/received_events","type":"User","site_admin":false},"created_at":"2017-04-16T09:26:04Z","updated_at":"2017-04-16T09:26:04Z","body":"I think your redirect uri should be `http%3A%2F%2F127.0.0.1%3A8091%2FauthResponse%3Fcontinue%253Dhttp%3A%2F%2Flocalhost%3A4200%2Fassets%2Foauth.html%2526client_id%253D39691` when passed as a query parameter. \r\n\r\nCould you try with this value? "}}
{"actor":{"display_login":"Spomky"}}