Bug: OAuth 2.0 State Parameter fails with Pipe Delimiters (RFC 6749 Non-Compliance)

https://accounts.zoho.com/oauth/v2/auth?response_type=code
    &client_id=<client_id>
    &scope=<scope>
    &redirect_uri=<redirect_uri>
    &access_type=offline
    &state=<state_value>

// Instead of using pipes as delimiters:
state = csrf_token + "|" + user_id + "|" + redirect_path;
// ❌ This breaks Zoho's authorization flow

// Developers must use alternative approaches:
state = csrf_token + "_SEP_" + user_id + "_SEP_" + redirect_path;
// or
state = base64_encode(json_encode({"csrf": token, "user": id, "path": path}));
// or
state = csrf_token; // Store other data server-side keyed by CSRF token

• Topic Participants

• Damien Cregan

  

• Sticky Posts

• Deprecation of SMS-based multi-factor authentication (MFA) mode

  Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

• Recent Topics

• Deluge date time issue

  The deluge function info zoho.currentdate.toString("MMM/YYYY") returns Dec 2026 instead of 2025

• Zoho Projects Android and iOS app update: Mobile device permission based on user profiles

  Hello everyone! We have brought in support for mobile device permissions based on the user profiles which are configured in organization level. Administrators can now configure the permissions on the web app(projects.zoho.com) by following the steps mentioned

• treatment for rehires

        Hello,  we are aware of the fact that Zoho People at the moment does not has a provision for rejoining exited employees. But is there any quick fix or hack to this? It will be appreciated a lot. 

• Zoho Projects Android and iOS app update: Timesheet module is now renamed as 'Time Logs', delete option has been renamed to 'Trash'.

  Hello everyone! We have now renamed the Timesheet module as Time Logs and the delete option as 'Trash' on the Zoho Projects Android and iOS app. Time Logs Android: Time Logs iOS: Trash option Android: Trash option iOS: Please update the app to the latest

• Zoho Mail app update: Manage profile picture, Chinese (Traditional) language support

  Hello everyone! In the latest version (v3.1.9) of the Zoho Mail app update, we have brought in support to manage profile picture. You can now set/ modify the profile picture within the app. To add a new profile picture, please follow the below steps:

• Reminders for Article Approval

  Is there a way to send reminders for approvers to review articles and approve/deny them? I'm not seeing that option anywhere.

• Add Full-Screen Viewing for Quartz Recordings in the Client Interface

  Hi Zoho Team, We would like to request an enhancement to the Zoho Quartz client interface when viewing submitted recordings. Current Limitation: When viewing a Quartz recording from the client (user) interface, there is currently no option to switch the

• 2025 Recap: A Year to Remember | Zoho Inventory

• Important Update : Pipedrive deprecated fields no longer supported in Zoho Analytics

  Dear Pipedrive users, We would like to inform you about a recent update related to your Pipedrive integration with Zoho Analytics. The Pipedrive team has deprecated certain fields from their application. You can find more details in the official Pipedrive

• Product Updates in Zoho Workplace applications | November 2025

  Hello Workplace Community, Let’s take a look at the new features and enhancements that went live across all Workplace applications this November. Zoho Mail Format comments easily using Slash Commands With Slash commands, you can easily format text, insert

• Right-Click Pipeline to Open in New Tab

  Please add the ability to right-click on a pipeline to open it in a new tab

• Adjusting Physical Inventory

  Not getting very far with support on this one, they say they are going to fix it but nothings happened since November. Please give this a thumbs up if you would like to see this feature or comment if you have some insight. Use Case: Inventory set to be

• sync views to sheet

  Im looking to sync my views aka reports in analytics to zoho sheets, when data is updated in analytics it also should be updated in sheets, till now zoho sheets only offer raw data connection and it is not enough as these reports are difficult to re-do

• How to update the Status in a custom module?

  Hi, I have a custom module "cm_payment_registry" in Billing, I am trying to change the status which is "Draft" with: array = {"custom_status":"Approved"}; zoho.billing.update("cm_payment_registry",organization.get("organization_id"), XXXXXXXXXXXXXX, array,"connectionname");

• Replace Zoho Invoice with QuickBooks

  We are implementing Zoho FSM for a cleaning business in the US with 50+ field workers. This business has been using Quickbooks for accounting for decades and will not migrate to Zoho Books. A major issue in the integration is the US sales tax calculation.

• 2025 Highlights: A Year of Steady Progress and Significant Developments

  As we come to the end of 2025, let's take a moment to reflect on the significant progress and developments we've made to improve your travel and expense management. In the Spotlight Introducing Online Booking (US edition only - Early access) Enable online

• Function #42: Show the actual rate of items on invoices

  Hello everyone, and welcome back to our series! In Zoho Books, you have the ability to create Price Lists, wherein you can mark up and mark down the item rates by a specific percentage or set custom rates. Generally, when you apply a price list to an

• Ability to Set Text Direction for Individual Cells in Zoho Sheet

  Dear Zoho Sheet Team, We hope you are doing well. We would like to request an enhancement in Zoho Sheet that allows users to set the text direction (right-to-left or left-to-right) for individual cells, similar to what is available in Google Sheets. Use

• Warehouse fast processing

  Hey guys, would anyone be interested in something like the attached image ? If there's any interest I'd be willing to develop it further for others to use, it's much faster than using Zohos native solutions, it can part pack, pack in full, part ship,

• Can I create a CODE 128 custom field for my items in Zoho Inventory and then use it for generating Sales Orders?

  Can anyone helps me, I don't want to use the SKU code for scanning my products.  ​Because all my products have a CODE-128 label attached.

• Start/Stop Timmer in Chrome Extension

  The chrome extension is great and allows you to do allot however one of the most common things employees working on projects need to do is track their time. Having an easy start/stop timer to track time would be great.

• Invalid collection string

  I haven't changed anything in one of my functions. I'm trying to run it manually and suddenly "Invalid collection string" appears. My code has 6 lines and the error says that the error is on 7th line. Why? What does this error mean? Nothing has been changed

• Zoho Directory 2025: New Features | Security Enhancements | Enriched UI

  Hello everyone, Greetings from the Zoho Directory team! 2025 has been a highly successful year for Zoho Directory. We are delighted to introduce a fresh set of features, an enriched UI, and major product enhancements. These updates aim to deliver a smoother

• zoho people 5 report

  How do I customize my report in Zoho People Report? I understand that I can get the results of multi-table queries through SQL join statements, but I don't know the relationship between each table. I tried to create a report using Attendance User Report

• Leave Report Emailed Weekly

  I am wondering if someone knows how to have a report generated either weekly or monthly or both for department heads and ownership of upcoming employee leave. For instance, it would be nice to get an emailed report on Friday for the upcoming week of who

• Zoho Flow Decision Continuing Despite Not Meeting Conditions

  I have a picklist field called Lead Status in the leads module, with the following lead Statuses: New Lead Attempted Contact - 1 Attempted Contact - 2 Attempted Contact - 3 Attempted Contact - 4 Attempted Contact - 5 Attempted Contact - 6 Attempted Contact

• Tip #55- Accessibility Controls in Zoho Assist: Exploring Vision Settings- 'Insider Insights'

  As we approach the end of the year, it’s a good moment to reflect on how we can make our tools more inclusive and easier to use for everyone. Remote support often involves long hours in front of screens, varied lighting conditions, and users with different

• Zoho Recruit Slow and Freezing on all screens

  We have had an issue with Zoho Recruit for weeks being extremely slow and at times freezing.  We have 100 mega internet, and I went into each computer and updated the virtual memory so there is more available.  Also restarted all computers daily.  Still having the issues.  Almost unable to work.

• Credit Management: #2 Configuring Right Payment Terms for Credit Control

  Think about the last time you ordered something online and saw that little note at the checkout, "Pay on Delivery" or "Pay later". It's simple, but it actually sets the tone. As a business owner, you know exactly when payment is expected. Now, imagine

• Dependent (Conditional) Fields in Zoho Bookings Forms

  Hello Zoho Bookings Team, Greetings, We would like to request the ability to create dependent (conditional) fields in Zoho Bookings registration forms. Current Limitation: There is currently no way to make one field’s available options depend on the value

• Bug Report: Search fails to find existing notes after Evernote import

  Hello, I recently migrated from Evernote (~2600 notes across 23 notebooks), but the search functionality is currently broken. The Issue: I can manually browse to a specific note and see it exists. However, when I type the exact or partial title of that

• Marketing Tip #13: Win repeat customers with post-purchase emails

  The relationship with your customer doesn’t end after the sale; that’s when it begins. A thoughtful post-purchase message shows customers you appreciate them, keeps your brand top of mind, and can even lead to another sale. You can thank them, ask for

• Zoho Form

  I have problem with Zoho Form. One of form i don't received the PDF version. Others okay except this one. W904533

• Create & Update Zoho Vault Passwords via Zoho Flow

  Hi Zoho Flow / Zoho Vault Team, We’d like to request an enhancement to the Zoho Vault integration in Zoho Flow. Current Limitation: At the moment, Zoho Flow supports only the following selected Zoho Vault actions, such as: Fetch passwords, Share passwords

• Custom Related List Inside Zoho Books

  Hello, We can create the Related list inside the zoho books by the deluge code, I am sharing the reference code Please have a look may be it will help you. //..........Get Org Details organizationID = organization.get("organization_id"); Recordid = cm_g_a_data.get("module_record_id");

• Migrate different zoho subscription to zoho one

  Dear We have different zoho subscription we need to migrate it to zoho one. Currently we are paying for zoho email, zoho expense, zoho payroll etc under different admin We need to move it too zoho one flexlible plan for all my employees

• Features, Feedback and Votes

  We’re launching the Feedback Forum for our customers. This is 'THE' place where you can add everything you’d like to see in Zoho Books. If you don't find the specific feature you need, simply add it so others can also vote for it. While we cannot promise

• There Might Be A Glitch in Determining If A String Represents A URL

  I suspect there might be a glitch in determining if a string represents a URL or not. For example, I cannot embed the following URL. Perhaps the exclamation mark or parentheses are the culprit? https://en.wikipedia.org/wiki/How_the_Grinch_Stole_Chri

• Customer Management: #4 Enhance Customer Journey

  When Neha started DefineOps, a growing IT support and consulting firm, most of her work was straightforward. A client would sign up for a free version, decide whether the service works for them, and then either continue or discontinue. Billing was simple,

• Android app sync problem - multiple devices have same problem

  Hello, I am having a problem with synchronization in the Android app. When I create a drawing, the data does not sync correctly—only a blank note is created without the drawing. I tested this on multiple devices, including phones and tablets, and the

• Next Page