# Bug OP-18238 - OpenID Connect: Claims escaped twice

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-18238

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module | Authentication / OpenID Connect (OIDC) |
| Target versions | 16.6.2 |
| Observed in versions | 16.6.0 |
| Sprint | 16.6.2 |
| Backlog bucket |  |
| Bug found in version (deprecated) | 16.6.x |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Jan Sandbrink |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

1.  Configure an OpenID Connect provider
    
2.  Configure it to request claims
    
    1.  Either by configuring claims in the "Claims" config section (to be confirmed that this reproduces the error)
        
    2.  Or by configuring synchronization of groups
        
3.  Try to login through the provider
    
4.  Observe the URL that the browser is redirected to (first URL at the IDP)
    

### What is the buggy behavior?

The claims parameter is escaped twice. For example the claims parameter from configuring group synchronization might look like this:

```text
claims=%257B%2522id_token%2522%253A%257B%2522groups%2522%253Anull%257D%257D
```

The code `%25` escapes the `%` sign, so decoding the above URL leads to the URL that we would have expected in the first place.

### What is the expected behavior?

The claims parameter should only be URL encoded once:

```text
claims=%7B%22id_token%22%3A%7B%22groups%22%3Anull%7D%7D
```

###   

**OpenProject version**

Observed on 16.6.0, on-premise.