[CXF-6985] parameter state may contain spaces, it must be urlencoded in response.

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.1.6
• Fix Version/s: 3.1.8, 3.2.0
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Svein Otto Solem
• Created: 01/Aug/16 10:03
• Updated: 21/Oct/16 18:45
• Resolved: 02/Aug/16 13:38

Description

In org.apache.cxf.rs.security.oauth2.services.AbstractImplicitGrantService the state parameter is not queryEncoded. Since it could contain spaces (as of RFC 6749 https://tools.ietf.org/html/rfc6749#page-72) it should be queryEncoded in method finalizeResponse.