Recorded 14 Oct 2026 at 10:19 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.
Bug fix: Microsoft Entra ID will no longer URL-encode the state parameter twice
Effective date: May 2021 Endpoints impacted: v1.0 and v2.0 Protocol impacted: All flows that visit the /authorize endpoint (implicit flow and authorization code flow) A bug was found and fixed in the Microsoft Entra authorization response. During the /authorize leg of authentication, the state parameter from the request is included in the response, to preserve app state and help prevent CSRF attacks. Microsoft Entra ID incorrectly URL-encoded the state parameter before inserting it into the response, where it was encoded once more. This would result in applications incorrectly rejecting the response from Microsoft Entra ID. Microsoft Entra ID will no longer double-encode this parameter, allowing apps to correctly parse the result. This change will be made for all applications.
What it said
- Published
- 1 May 2020
- Product
- Microsoft Entra
Recorded links
What changed
First observed 14 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.