Recorded 14 Oct 2026 at 10:19 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.
POST form semantics will be enforced more strictly - spaces and quotes will be ignored
Effective date: September 2, 2019 Endpoints impacted: Both v1.0 and v2.0 Protocol impacted: Anywhere POST is used (client credentials, authorization code redemption, ROPC, OBO, and refresh token redemption) Beginning the week of September 2, 2019, authentication requests that use the POST method will be validated using stricter HTTP standards. Specifically, spaces and double-quotes (") will no longer be removed from request form values. These changes aren't expected to break any existing clients, and will ensure that requests sent to Microsoft Entra ID are reliably handled every time. In the future (see above) we plan to additionally reject duplicate parameters and ignore the BOM within requests. Example: Today, ?e= "f"&g=h is parsed identically as ?e=f&g=h - so e == f. With this change, it would now be parsed so that e == "f" - this is unlikely to be a valid argument, and the request would now fail.
What it said
- Published
- 1 Aug 2019
- Product
- Microsoft Entra
Recorded links
What changed
First observed 14 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.