Bug in Oauth2 URL Auth Code decoding

[Tom DC]

In the oAuth2 authentication process, after login in, we recieve an auth code + state as parameters in the URL


URL
Code=OI1TFgxKXLDgoRnavIcVWW3OnFC5lSn2eOb3%2FC5M5JlaZC3U0w6pH7Q1sPuN07t8fPPnlSOQaETDxiiV4KdHBzv%2Bszsz6EyWDyaAd0yt1wZMaomxZ8k9havHG0CFa4q%2BJY1%2BtaEaa%2FF3MefCBbSpdZIpiyZ7eOV9VKHURw797cNFv%2BW0mhKkBFZsEx0c5MO4ozZZvEja5UcmBGZ8CApU4P4UbWehwNzIElTYvdsDf8PqkdUcMkiVz0x0WeRB6xdl5L1Lguq4ZOGAzF32zVOTP8eJ8PeqRrpNk3jEdS82hPJI%2FPYkUSf5cbZX2cw7vPgtpRIHRftqpnMLLgM%2FB8kryysdJ2KIxKIlWX7Yasxu6uo4uqT50xSEnPDFYqZgeQMDcNM%2BumTd1HnqN1D0n6ogNXpNvnYUSfuig7pOEE98SZDe9q6%2BBXxU8vQbzWGbv25Tq20%2FJaZkbKXCQY6lhUSaH%2FwQcpnspy57HkkUULYKTkvfmWvbAzdZMKd0abnIWp6FE5bv%2BTcQJNs0XV90FrsGjB5kJvce3uzNOMyRoEJfoV37XiGwM%2Fnxn66s0kHr5c8QW%2BdouUT29UDKKu6MjgL2JJfGAIGxYzEqZsSPJN8hM%2BrKc6xxo6R0FacmH0KWNY82me%2BFZ2XWW9AELebxupZrjsa6IedGDtigb%2FyH5zJyekY0gR7SiKUSBIglt0sCbcNSnB4KJLyi8sgi3HpC%2BvAB4ARv5YLNPL3SMl7%2FPuBO2gYpqGPZUPAgxWMFEUHncV8Yy6NZFYMcbCHp7C5o2j9ezDAcLfOxggOAhPzHENl7dKy0TZARt8cmFliI0ivfb4jSP14iB3i2GFNLTOLcDv2r2w%3D%3D

3CX decodes the URL as
Code=OI1TFgxKXLDgoRnavIcVWW3OnFC5lSn2eOb3/C5M5JlaZC3U0w6pH7Q1sPuN07t8fPPnlSOQaETDxiiV4KdHBzv szsz6EyWDyaAd0yt1wZMaomxZ8k9havHG0CFa4q JY1 taEaa/F3MefCBbSpdZIpiyZ7eOV9VKHURw797cNFv W0mhKkBFZsEx0c5MO4ozZZvEja5UcmBGZ8CApU4P4UbWehwNzIElTYvdsDf8PqkdUcMkiVz0x0WeRB6xdl5L1Lguq4ZOGAzF32zVOTP8eJ8PeqRrpNk3jEdS82hPJI/PYkUSf5cbZX2cw7vPgtpRIHRftqpnMLLgM/B8kryysdJ2KIxKIlWX7Yasxu6uo4uqT50xSEnPDFYqZgeQMDcNM umTd1HnqN1D0n6ogNXpNvnYUSfuig7pOEE98SZDe9q6 BXxU8vQbzWGbv25Tq20/JaZkbKXCQY6lhUSaH/wQcpnspy57HkkUULYKTkvfmWvbAzdZMKd0abnIWp6FE5bv TcQJNs0XV90FrsGjB5kJvce3uzNOMyRoEJfoV37XiGwM/nxn66s0kHr5c8QW douUT29UDKKu6MjgL2JJfGAIGxYzEqZsSPJN8hM rKc6xxo6R0FacmH0KWNY82me FZ2XWW9AELebxupZrjsa6IedGDtigb/yH5zJyekY0gR7SiKUSBIglt0sCbcNSnB4KJLyi8sgi3HpC vAB4ARv5YLNPL3SMl7/PuBO2gYpqGPZUPAgxWMFEUHncV8Yy6NZFYMcbCHp7C5o2j9ezDAcLfOxggOAhPzHENl7dKy0TZARt8cmFliI0ivfb4jSP14iB3i2GFNLTOLcDv2r2w==

Problem
The special character + (%2F) is decoded as a space. The URL string might be double decoded.



I have connected with PHP and postman to the remote CRM. Everything works.

While it might be a strange design choice of the remote CRM to use special characters for the Auth Code in the URL, it is definately a bug in 3CX.


I have created a support ticket 367102 on 25 Jan 2019 . Unfortunately it isnt moving . I have debugged hours and days on this issue. I really hope the 3cx developers could take a look at this.

This CRM integration would give me a real sales advantage .

I have a test account to the remote CRM, with client ID and client secret. This can be provided to the programmers for testing purposes

Kind Regards,
Tom

 

[Tom DC]

Or is the microsoft library faulty encoding/decoding the + character

System.Net.WebUtility.UrlEncode

https://stackoverflow.com/questions...instead-of-in-system-net-webutility-urlencode

 

[edossantos]

Please send us the template you have created, so we can take a look at the OAuth2 implementation...