Bug fix: Microsoft Entra ID will no longer URL-encode the state parameter twice

Effective date: May 2021 Endpoints impacted: v1.0 and v2.0 Protocol impacted: All flows that visit the /authorize endpoint (implicit flow and authorization code flow) A bug was found and fixed in the Microsoft Entra authorization response. During the /authorize leg of authentication, the state parameter from the request is included in the response, to preserve app state and help prevent CSRF attacks. Microsoft Entra ID incorrectly URL-encoded the state parameter before inserting it into the response, where it was encoded once more. This would result in applications incorrectly rejecting the response from Microsoft Entra ID. Microsoft Entra ID will no longer double-encode this parameter, allowing apps to correctly parse the result. This change will be made for all applications.