Oauthv2 policy encoding issue for special character # in redirectURI

[Ramchanderch]

We are seeing an issue in usage of OAuthv2 policy in a multi legged OAuth. We are having a scenario where the policy fails when the redirect URI (form param) has "#" character. Content type of the request is application/x-www-form-urlencoded.

It is surprising that even when the consumer sends redirect URI encoded/decoded, the string is decoded while the policy is reading data from the input and fails with 500 status code.

Is it expected that the policy to decode the form param content? Is it something apigee can fix?

Note: This issue can be mitigated by force encoding the data by using a JS function - encodeURIComponent()

[dchiesa1]

I don't know if Apigee can fix this , possibly.

We'd need a reproduction or illustration.

Since you have a workaround that's pretty easy... maybe you can just use that?