Bug: OAuth 2.0 State Parameter fails with Pipe Delimiters (RFC 6749 Non-Compliance)

Bug: OAuth 2.0 State Parameter fails with Pipe Delimiters (RFC 6749 Non-Compliance)

I've discovered a bug in how Zoho's API Console handles the OAuth 2.0 authorization flow when the state parameter contains pipe characters (|), and I'm hoping the Zoho team can address this in a future update.
The Issue
Zoho's OAuth 2.0 implementation for server-based client applications uses the standard authorization endpoint: 
https://accounts.zoho.com/oauth/v2/auth?response_type=code
    &client_id=<client_id>
    &scope=<scope>
    &redirect_uri=<redirect_uri>
    &access_type=offline
    &state=<state_value>
While Zoho's documentation does not explicitly list the state parameter, it is a standard part of the OAuth 2.0 specification (RFC 6749 Section 4.1.1) and is widely used for CSRF protection and maintaining application state through the authorization flow.
However, when the state parameter contains pipe characters (|), Zoho's authorization server fails to process the request correctly, preventing users from authorizing the connection. This occurs whether the pipe characters are URL-encoded (%7C) or left unencoded.
The Problem
The pipe character is a standard delimiter in multi-part state values, particularly when passing a combination of a CSRF token and a return URL. This behavior—failing on both encoded and unencoded pipe characters—is often indicative of overly restrictive input validation or a "leaky" WAF/Proxy layer that decodes parameters before the application logic can handle them.
State Value As Sent in URL Result
abc123xyz state=abc123xyz ✓ Works correctly
session_12345 state=session_12345 ✓ Works correctly
user|action|timestamp state=user|action|timestamp
(unencoded pipes)		 ✗ Authorization fails
user|action|timestamp state=user%7Caction%7Ctimestamp
(URL-encoded pipes)		 ✗ Authorization fails
user:action:timestamp state=user%3Aaction%3Atimestamp ? Not tested
Note: Pipe characters cause failures whether URL-encoded or not. Other special characters/delimiters have not been tested and may or may not exhibit similar issues.
RFC 6749 Compliance Issue
Section 4.1.1 - Authorization Request:
"state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback."
Section 4.1.2 - Authorization Response:
"state: REQUIRED if the 'state' parameter was present in the client authorization request. The exact value received from the client."
The RFC explicitly defines the state parameter as an opaque value. This means:
  • The Authorization Server should not be looking "inside" or parsing the string at all
  • The state value must pass through the authorization process unchanged
  • Any URL-encoded characters should be handled transparently
  • The exact value received must be returned to the client in the redirect
Key Point: By definition, an "opaque" parameter means the authorization server must treat it as a data blob—accepting it, storing it, and returning it without any interpretation or transformation.
Current Behavior vs Expected Behavior
Current Behavior Expected Behavior (Per RFC 6749)
1. Client sends: state=user|action|123
(or state=user%7Caction%7C123)
2. Zoho fails to parse the state parameter
3. Authorization server returns HTTP 400 Bad Request
4. User cannot authorize the connection 		1. Client sends: state=user|action|123

2. Zoho treats state as opaque data blob
3. User authorizes the connection
4. Redirect includes the exact value received:
state=user|action|123
(or consistently encoded as sent)
The Current Workaround (Suboptimal)
Important: The workarounds below only apply if you have control over the client application generating the OAuth request. If you're integrating with a third-party application that sets the state parameter (e.g., integration platforms, SaaS tools, enterprise software), you have no ability to modify the state value and therefore no workaround is available. You are completely blocked from completing the OAuth flow.
For developers who do control the client application, you must avoid pipe characters entirely: 
// Instead of using pipes as delimiters:
state = csrf_token + "|" + user_id + "|" + redirect_path;
// ❌ This breaks Zoho's authorization flow

// Developers must use alternative approaches:
state = csrf_token + "_SEP_" + user_id + "_SEP_" + redirect_path;
// or
state = base64_encode(json_encode({"csrf": token, "user": id, "path": path}));
// or
state = csrf_token; // Store other data server-side keyed by CSRF token
Problems with these workarounds:
  • Requires refactoring existing codebases that use pipe delimiters
  • Base64 encoding increases state parameter length significantly, risking URL length limits (particularly in older browsers and some enterprise proxies which enforce ~2000 character limits)
  • Server-side storage approach adds complexity, database overhead, and potential race conditions
  • Inconsistent with how the same code works with other OAuth providers (Google, Microsoft, etc.)
  • Developers may not discover this issue until production deployment
  • Custom delimiters (like _SEP_) are non-standard and may conflict with actual data values
What Should Happen Instead
Proposed Solution:
Zoho's authorization server should properly handle URL-encoded pipe characters (%7C) in the state parameter, as required by RFC 6749. The state value must be treated as an opaque data blob.
Technical Requirement: Treat state as a Data Blob
1. Input Accept %7C (and other encoded characters) as valid parts of the query string without triggering validation errors or WAF rules
2. Persistence Store the string exactly as received during the user's login/consent session—do not decode, parse, or transform
3. Output Append the exact string back to the redirect_uri without additional transformations that might strip or corrupt the delimiters
This approach:
  • Complies with RFC 6749's requirement to return "the exact value received"
  • Follows the same behavior as other major OAuth providers
  • Requires no changes from client applications
  • Unblocks third-party integrations that cannot modify their state format
Real-World Impact
This limitation affects any integration where:
  • Third-party applications set the state parameter and cannot be modified (integration platforms, SaaS connectors, enterprise software)
  • Multi-tenant applications need to encode tenant ID and return URL in state
  • CSRF protection implementations combine security tokens with application state
  • Single Sign-On flows need to preserve original request context
  • Migration projects from other OAuth providers that used pipe delimiters

Critical Blocker: When the state parameter originates from a third-party system outside your control, there is no workaround available. The integration is completely impossible until this is fixed.

Security Note: The state parameter is critical for CSRF protection in OAuth flows. Forcing developers to change their state encoding approach may inadvertently introduce security vulnerabilities if not handled carefully.

Request to Zoho Team

Can this be addressed in a future update?

This is a standards compliance issue that impacts developers integrating with Zoho's API. For those who control their client application, the current implementation forces unnecessary workarounds. For those integrating third-party applications, the situation is worse:

1. Custom development
Refactor code to avoid pipe characters, creating Zoho-specific OAuth handling 		2. Third-party integrations
No workaround possible - integration is completely blocked

Users should not be blocked from integrating with Zoho due to non-standard OAuth implementation.

Community Input Requested: Has anyone else encountered this issue? Are there other special characters that cause similar problems with Zoho's OAuth implementation?

    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

      • Recent Topics

      • Cash Basis VAT RETURN REPORT Required in Saudi Arabia

        Zoho Books in Saudi Arabia not showing TAX RETURNS report on CASH Basis.. It only showing accrual basis. Oforur requirement is both reports (Cash Basis and Accrual Basis ) , same like indian Edition of Zoho Books showing. CASH BASIS RETURN is our Basic

      • Tips & Tricks Series - #4 Customize your manual PDF before export

        Hello everyone! We’re back again with our Tips & Tricks series. Today, we’ll look at how you can customize your manual PDF before exporting it. With Zoho Learn, you can personalize the exported PDF with options such as headers, footers, colors, and custom

      • Digital Marketing Agency: Transforming Your Brand's Online Presence

        Imagine trying to build a house on your own without the necessary tools or expertise—it’s overwhelming, right? Digital marketing is the same.

      • Losing description after merging tickets

        Hello, We merge tickets when they are about the same topic from the same client. It happens sometimes. We recently noticed that after the merger only the description from the master ticket is left in a thread. And the slave-ticket description is erased.

      • How to Convert Emails to PDF Format in Batch

        It is helpful to convert emails into PDF format when you want to save important messages, when you need to share business correspondence, or when you wish to keep email records for future reference. PDF files can be readily opened, printed, and shared

      • Introducing Zoho Key Service, a simpler way to access LLMs without API keys

        Available in the Professional, Enterprise, and Ultimate editions in the US, IN, AU, JP, and CA DCs. Hello everyone, We are excited to bring Zoho Key Service (ZKS) in Zoho CRM, a simpler way for organizations to access and use third party LLMs. You can

      • Reach us through our official support channels

        Dear Customers, Thanks a lot for choosing Zoho! Our applications are built to help achieve your day-to-day business goals. We are committed to engaging with you, to understand and develop solutions that enhance your productivity. We are happy and ready

      • I cannot add user to my account

        I have an account, I deleted a user from the account and I have one unused licence which lasts for 23 days, I tried adding a new user and it said This user is not allowed to add in Zoho. Please contact support-as@zohocorp.com for further details, please

      • Domain Activation Issue

        I purchased a domain through Zoho, and as I understand it, you were supposed to send me a domain activation link. However, I never received it. As a result, I was unable to activate the domain, and it is now suspended. Because of this, I am not receiving

      • Grouping by Stage *type* in widgets

        Hi Can I ask for a new feature? I'd like to be able to group by stage type in a Deal widget. That is by whether the Deal is in an Open Stage, a Closed Won Stage, or a Lost stage. Currently I can group by Stage, but if we have 10 open stages and one Closed

      • Please release domain bravovietnam.com from an old account

        Hello Zoho Support, I am trying to set up Zoho Mail with my domain bravovietnam.com on my account office@bravovietnam.com. Every time I add the domain, I get: "This domain is already associated with this account" — pointing to a DIFFERENT, older account

      • Creator -Dynamic addition of Customer Portal User Licenses

        Hi, We have a Creator App for B2C about to get released. We are experiencing the Portal User license challenge. Unable to predict the number of users who will download and Subscribe. When a User is about Subscribe and the portal licenses does not exists,

      • Migrate Mailbox between Microsoft 365 tenants - Safe, Fast & Easy

        Moving mailboxes between Microsoft 365 tenants is a difficult proposition when you've got a large number of user accounts, a lot of email data and a number of Microsoft 365 services to contend with. This is a common scenario when a business is undergoing

      • 👍 Zoho CRM's Notes now gets Reactions and a new look

        Available in SA and JP DCs. Rolling out to other DCs in phases. Hello everyone, Notes help users capture important updates, collaborate with teammates, and maintain context for records. Now with Note Reactions, users can quickly acknowledge updates, express

      • Widget Height were destroyed

        All widget heights in the Details Canvas view are broken. Moderation Update: This is a known issue with widget heights in Client Script popups and flyouts. A fix is in progress, and this post will be updated once it's released.

      • Introducing Incentives for Zoho CRM: Build, automate, and track sales commissions

        Dear Customers, We are here with an amazing news! We built a direct solution to help manage your commission provisioning activity in your business. From creating commission plans to issuing payouts, this application leverages your sales reps’ performance

      • Enhanced Zoho CRM and Office 365 calendar synchronization features!

        Dear customers, We're excited to share some significant improvements to our Office 365 calendar synchronization features, aimed at providing you with more control and a more personalized experience. What’s new Choose your Office 365 calendar: During the

      • Zoho Books Support

        Dear Team, Zoho Books offers a demo before you purchase zoho books. But after that when he actually purchases the product he has to rely on toll free number or help documents. But this might get frustrated in the initial period. Specially in initial period.

      • How to add a fee based on payment method

        I currently accept both ACH payments and credit card. I want to add a 3% fee to a number of my subscription plans if the customer chooses to use a credit card (and not ACH/checking). How do I do this? Is there an in-built feature, or would i have to create

      • Mirror Component in Zoho CRM: Access real-time related data without leaving your record

        Hi everyone, This feature is now available for the JP, CA, SA, UAE, and AU DCs. We're excited to bring to you Zoho CRM's mirror component, which presents relevant data on a record's details page and keeps everything users need in one place without having

      • What's New in Zoho Invoice | July – September 2026

        Hello everyone! We're back with the latest updates and enhancements we've rolled out in Zoho Invoice from July to September 2026. Here's what's new this quarter: Zoho Invoice is Now Available in Nigeria Introducing the Super Admin Privilege E-Invoicing

      • Convert MBOX to PDF Free on Mac and Windows

        MBOX files are widely used for storing email messages in email clients such as Thunderbird, Apple Mail, and other programs that support the MBOX format. Although this format is useful for handling emails, it can at times be inconvenient to access the

      • Notes - Reaction Buttons

        Using the native notes option within CRM is fine, it works and the RTF features are great, however, would it be possible - if there isnt already something in place, where we can add a reactions button, similar to teams/whatsapp to show that its been read

      • ZohoBooks - "Account transactions" report doesn't have any "Desciptions"

        Hi, I'd like to push for this to be included in ZohoBooks: In a "account transactions" report all the numbers are right, but I'd really like to see the "Description" as part of this report, i.e. the line-item-description as I would see it in the bank statement. Essentially all you see is a list of numbers adding up to the total. It is very difficult to see if things are right without being able to see what exactly each transaction refers to. Going into each transaction one-by-one is not a workable

      • Address limits per customer by edition

        I’m on the Standard edition and have reached a limit of 30 addresses under a single customer. Before I move to an annual Professional subscription, I need to confirm the following: What is the maximum number of addresses allowed under one contact, and

      • Export from List view

        I'm constantly having the issue where my users are building lists in ListView for various objects and then realising they cant export the data, then they have to go and build the data set in reports to export. I would like to see the ability to export to excel/csv from ListView.

      • Cannot apply tags to multiple items at once

        It is very frustrating needing to apply tags to notes individually. Even worse that it takes multiple clicks to do it. Can there please be an update to: 1.) Allow us to apply tags to batches of notes in one go. 2.) Make it less clicks to add a tag 3.)

      • Get all hiring updates via Zoho Cliq bot notifications

        We’re introducing a new way to stay updated on recruitment activities: Cliq Bot notifications. Now you can receive Zoho Recruit notifications directly in Zoho Cliq—alongside your existing in-app alerts and emails. Whether it’s a candidate status change,

      • Notes Acknowledgement

        It would be great to have emojis that can be used for Notes. Emojis such as Thumbs Up to let someone know you agree with them or a emoji for thanks. It's a simple way to acknowledge that you read someone's note. Moderation update: Emoji reactions for

      • Is it possible to log text messages from iphone into Zoho CRM

        My team is more and more utilizing text messaging to communicate with clients. Does Zoho have a solution for logging these text messages when clicking "Send Text Message" from the Zoho app. Much like when you call, you get prompted to log a call, can

      • Project Finances: Fully Accessible within Projects

        Project finances and work items are now on the same screen and it transforms the way you run your project. Managing your project finances is now much easier and in the same screen as your work items. Access quotes, invoices, bills, sales orders, and purchase

      • zoho stream web notifications

        since im locked out of IMAP and cant use my mail app that lets my team collaborate and chat below emails, im trying out the zoho version of this... zoho streams. On the bottom of an email in the zoho mail web app, i "comment" and mention another user.

      • UI / UX Improvements

        Please consider changing the Dependency Details window from a column-based layout to a list-based layout, or allowing users to choose their preferred layout. The current column-based view uses screen space inefficiently and makes navigation difficult,

      • Zoho CRM and Desk sandboxes for testing native integration

        Hello team, We are evaluating the native integration between Zoho CRM and Zoho Desk, We have sandbox instances of both products and want to test the integration there, without any effect on our production CRM or production Desk data. While setting up

      • Function #24: Automatically display deal name from Zoho CRM on quotes in Zoho Books

        Deals allow businesses to organize and visualize their sales pipeline. This provides a clear overview of all potential opportunities and helps in making informed decisions. Zoho CRM empowers you to create deals or potentials for your clients and monitor

      • Zoho Books | Product updates | August 2026

        Hello users, July has been an exciting month for Zoho Books! This month, we're excited to introduce HTML PDF Templates, Placeholders as Pills, expanded approval workflows for Sales Returns and Journals, and significant compliance updates across the India,

      • Auto-Sync Field of Lookup Values When Parent Record Changes

        Hi Zoho Team, Currently, when you use a "Field of Lookup" in Zoho CRM, the value is captured as a snapshot at the time the lookup is set. If the parent record is later updated, the Field of Lookup value on the child record does NOT update and stays stale.

      • [Request] Pivot filter date option : from set date to relative value ie from 01Jan to LastMonth

        I don't think I can currently do this... but it's worth asking if it's possible. My use case is concerning annual leave which is calculated from the beginning of the calendar year (01Jan) then each month I want to have details of leave taken etc... In

      • Customer Statement Showing Incorrect Negative Balance Due to Unused Advance

        Dear Zoho Support Team, We are facing an issue with the Customer Statement in Zoho Invoice related to customer advances/mobilization advances. The issue is that when a customer has made an advance payment that has not yet been fully utilized against invoices,

      • Mois de la sensibilisation à la cybersécurité 2026 : faites de la sécurité un réflexe avec Zoho

        Imaginez : vos systèmes informatiques répondent aux normes de sécurité en vigueur et votre entreprise est assurée contre les cyberattaques. Pourtant, un matin, tout bascule. Vos données sont chiffrées et un message glaçant s’affiche à l’écran : « Si vous

      • Next Page