Bug: OAuth 2.0 State Parameter fails with Pipe Delimiters (RFC 6749 Non-Compliance)

Bug: OAuth 2.0 State Parameter fails with Pipe Delimiters (RFC 6749 Non-Compliance)

I've discovered a bug in how Zoho's API Console handles the OAuth 2.0 authorization flow when the state parameter contains pipe characters (|), and I'm hoping the Zoho team can address this in a future update.
The Issue
Zoho's OAuth 2.0 implementation for server-based client applications uses the standard authorization endpoint: 
https://accounts.zoho.com/oauth/v2/auth?response_type=code
    &client_id=<client_id>
    &scope=<scope>
    &redirect_uri=<redirect_uri>
    &access_type=offline
    &state=<state_value>
While Zoho's documentation does not explicitly list the state parameter, it is a standard part of the OAuth 2.0 specification (RFC 6749 Section 4.1.1) and is widely used for CSRF protection and maintaining application state through the authorization flow.
However, when the state parameter contains pipe characters (|), Zoho's authorization server fails to process the request correctly, preventing users from authorizing the connection. This occurs whether the pipe characters are URL-encoded (%7C) or left unencoded.
The Problem
The pipe character is a standard delimiter in multi-part state values, particularly when passing a combination of a CSRF token and a return URL. This behavior—failing on both encoded and unencoded pipe characters—is often indicative of overly restrictive input validation or a "leaky" WAF/Proxy layer that decodes parameters before the application logic can handle them.
State Value As Sent in URL Result
abc123xyz state=abc123xyz ✓ Works correctly
session_12345 state=session_12345 ✓ Works correctly
user|action|timestamp state=user|action|timestamp
(unencoded pipes)		 ✗ Authorization fails
user|action|timestamp state=user%7Caction%7Ctimestamp
(URL-encoded pipes)		 ✗ Authorization fails
user:action:timestamp state=user%3Aaction%3Atimestamp ? Not tested
Note: Pipe characters cause failures whether URL-encoded or not. Other special characters/delimiters have not been tested and may or may not exhibit similar issues.
RFC 6749 Compliance Issue
Section 4.1.1 - Authorization Request:
"state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback."
Section 4.1.2 - Authorization Response:
"state: REQUIRED if the 'state' parameter was present in the client authorization request. The exact value received from the client."
The RFC explicitly defines the state parameter as an opaque value. This means:
  • The Authorization Server should not be looking "inside" or parsing the string at all
  • The state value must pass through the authorization process unchanged
  • Any URL-encoded characters should be handled transparently
  • The exact value received must be returned to the client in the redirect
Key Point: By definition, an "opaque" parameter means the authorization server must treat it as a data blob—accepting it, storing it, and returning it without any interpretation or transformation.
Current Behavior vs Expected Behavior
Current Behavior Expected Behavior (Per RFC 6749)
1. Client sends: state=user|action|123
(or state=user%7Caction%7C123)
2. Zoho fails to parse the state parameter
3. Authorization server returns HTTP 400 Bad Request
4. User cannot authorize the connection 		1. Client sends: state=user|action|123

2. Zoho treats state as opaque data blob
3. User authorizes the connection
4. Redirect includes the exact value received:
state=user|action|123
(or consistently encoded as sent)
The Current Workaround (Suboptimal)
Important: The workarounds below only apply if you have control over the client application generating the OAuth request. If you're integrating with a third-party application that sets the state parameter (e.g., integration platforms, SaaS tools, enterprise software), you have no ability to modify the state value and therefore no workaround is available. You are completely blocked from completing the OAuth flow.
For developers who do control the client application, you must avoid pipe characters entirely: 
// Instead of using pipes as delimiters:
state = csrf_token + "|" + user_id + "|" + redirect_path;
// ❌ This breaks Zoho's authorization flow

// Developers must use alternative approaches:
state = csrf_token + "_SEP_" + user_id + "_SEP_" + redirect_path;
// or
state = base64_encode(json_encode({"csrf": token, "user": id, "path": path}));
// or
state = csrf_token; // Store other data server-side keyed by CSRF token
Problems with these workarounds:
  • Requires refactoring existing codebases that use pipe delimiters
  • Base64 encoding increases state parameter length significantly, risking URL length limits (particularly in older browsers and some enterprise proxies which enforce ~2000 character limits)
  • Server-side storage approach adds complexity, database overhead, and potential race conditions
  • Inconsistent with how the same code works with other OAuth providers (Google, Microsoft, etc.)
  • Developers may not discover this issue until production deployment
  • Custom delimiters (like _SEP_) are non-standard and may conflict with actual data values
What Should Happen Instead
Proposed Solution:
Zoho's authorization server should properly handle URL-encoded pipe characters (%7C) in the state parameter, as required by RFC 6749. The state value must be treated as an opaque data blob.
Technical Requirement: Treat state as a Data Blob
1. Input Accept %7C (and other encoded characters) as valid parts of the query string without triggering validation errors or WAF rules
2. Persistence Store the string exactly as received during the user's login/consent session—do not decode, parse, or transform
3. Output Append the exact string back to the redirect_uri without additional transformations that might strip or corrupt the delimiters
This approach:
  • Complies with RFC 6749's requirement to return "the exact value received"
  • Follows the same behavior as other major OAuth providers
  • Requires no changes from client applications
  • Unblocks third-party integrations that cannot modify their state format
Real-World Impact
This limitation affects any integration where:
  • Third-party applications set the state parameter and cannot be modified (integration platforms, SaaS connectors, enterprise software)
  • Multi-tenant applications need to encode tenant ID and return URL in state
  • CSRF protection implementations combine security tokens with application state
  • Single Sign-On flows need to preserve original request context
  • Migration projects from other OAuth providers that used pipe delimiters

Critical Blocker: When the state parameter originates from a third-party system outside your control, there is no workaround available. The integration is completely impossible until this is fixed.

Security Note: The state parameter is critical for CSRF protection in OAuth flows. Forcing developers to change their state encoding approach may inadvertently introduce security vulnerabilities if not handled carefully.

Request to Zoho Team

Can this be addressed in a future update?

This is a standards compliance issue that impacts developers integrating with Zoho's API. For those who control their client application, the current implementation forces unnecessary workarounds. For those integrating third-party applications, the situation is worse:

1. Custom development
Refactor code to avoid pipe characters, creating Zoho-specific OAuth handling 		2. Third-party integrations
No workaround possible - integration is completely blocked

Users should not be blocked from integrating with Zoho due to non-standard OAuth implementation.

Community Input Requested: Has anyone else encountered this issue? Are there other special characters that cause similar problems with Zoho's OAuth implementation?



      • Sticky Posts

      • Deprecation of SMS-based multi-factor authentication (MFA) mode

        Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

        • Recent Topics

        • SalesIQ's Summer '26 Release: For The Moments That Matter

          Every customer journey is made up of moments. The moment someone discovers your business. The moment they need help. The moment you decide to reach out. The moment a simple chat turns into something more. And the moments that continue long after the conversation

        • Add Comprehensive Accessibility Features to Zoho Writer

          Hello Zoho Writer Team, We hope you are doing well. We would like to submit a feature request to enhance Zoho Writer with a full set of accessibility tools, similar to the accessibility options already available in the Zoho Desk agent interface. 🚧 Current

        • Pricelists

          So we have them in books but I cannot find them in commerce?

        • Desk Contact Name > split to First and Last name

          I am new to Zoho and while setting up the Desk and Help Center, I saw that new tickets created or submitted from the Help Center used the Contact Name field. This would create a new Contact but put the person's name in the Last Name field only. The First

        • Copying a Document with its Citations

          When I copy a document that contains citations using File>Make a Copy from the document's menu the text copies but the citations do not (according to Google they should). Is this the correct way to make a complete copy of a document with its citations

        • Bing ads integration and tracking

          Hi, Is there any way to track Bing ads in the same way that we are able to track google adwords?  It is important for us to be able to determine the conversion rate of our Bing ads.  If this is not possible now, will this feature be added in the future?

        • #20 Your Business Shouldn't Stop Just Because You Do

          Imagine you are on a well-deserved vacation. Your clients are expecting invoices at the beginning of the month, recurring customers are due for billing, and payments are still coming in. Do you carry your laptop everywhere, hoping you don't miss a billing

        • Marketing Tip #26: Optimize product images for SEO

          Product images can do more than make your store look good. They can also help customers discover your products through search. Since search engines can’t "see" images, they rely on text signals to understand what an image is about. Two small actions make

        • Canva Integration

          Hello! As many marketing departments are streamlining their teams, many have begun utilizing Canva for all design mockups and approvals prior to its integration into Marketing automation software. While Zoho Social has this integration already accomplished,

        • Automation Series: Mandatory Time Logging Before Task Closure

          In a project, when users work on multiple tasks simultaneously, they track time in different ways, either by starting a timer or by adding a time log. Sometimes users may forget to add time, which can lead to discrepancies in the timesheet. When timesheets

        • Is there a way to show contact emails in the Account?

          I know I can see the emails I have sent and received on a Contact detail view, but I want to be able to see all the emails that have been sent and received between all an Accounts Contacts on the Account Detail view. That way when I see the Account detail

        • Zoho CRM gets a new email compose and lot more

          Dear Customers,  [UPDATE October 21, 2021: We have started opening these features to some of the customers already. And, it will be available to all the customers before November 2nd Week, 2021. Sorry for the delay caused]  [UPDATE February 21, 2022:

        • Custom AI solutions with QuickML for Zoho CRM

          Hello everyone, Earlier, we introduced Custom AI Solutions in CRM that let you access QuickML for your custom AI needs. Building on that foundation, we’ve now enabled a deeper integration: QuickML models can be seamlessly integrated into CRM, and surface

        • Introducing document visibility in Zoho Sign

          Hello! Complex document workflows often involve multiple stakeholders with different roles. Sending a separate envelope to every person is time consuming and can lead to administrative bottlenecks. With Zoho Sign's document visibility feature, you can

        • Sent email stuck on processing

          My sent emails are stuck on processing, whats going on?

        • [Webinar] What's new in Zoho Analytics: Q2 2026

          Hey data lovers! Our What's New webinar series is bringing you another lineup of exciting features and product enhancements from the past quarter, all designed to help you get more out of your analytics. Get an inside look at new data connectors, Zoho

        • Alterar número de telefone para receber o código OTP

          Boa tarde! Como posso alterar o número de telefone da minha conta para aceder ao meu email corporativo? Estou tentando logar, mas não consigo, pois está sendo enviado o código OTP para o número antigo, preciso aceder urgente meu email, porque e de trabalho.

        • CRM x WorkDrive: We're rolling out the WorkDrive-powered file storage experience for existing users

          Release plan: Gradual rollout to customers without file storage add-ons, in this order: 1. Standalone CRM 2. CRM Plus and Zoho One DCs: All | Editions: All Available now for: - Standalone CRM accounts in Free and Standard editions without file storage

        • Request to Increase URL Field Character Limit

          Hi Arthi, Hope you are doing well. I'm trying to save a URL in the Work Order (WO) module using the URL field, but I receive the following error message: "Please enter a valid Repair File. Maximum 450 characters are allowed." The issue is that the URL

        • How to change column headings in pivot table?

          Hi, Is there a way to rename the column headers of a pivot table? Now some the columns are named with value labels: 'SUM of .....'. We would like to rename those headers. As of now we couldn't find any direct solution to adjust the headers, besides copying and reformat. We want to avoid these extra steps. Best, Tiemen

        • Undelivered Mail

          I suspect that there are recipient's servers that blocks my emails. I receive the following email from mailer-daemon@mail.zoho.eu : A message that you sent could not be delivered to one or more of its recipients. This is a permanent error. pantelis.sarantos@unipakhellas.gr,

        • Email not loading on PC

          Hello, my email opens on but it doesn’t load on PC. I don’t have other issues with the email, all the configurations are ok and I face with following issue in the photo. It says “ mail.zoho.com refused to connect” I will be very thankful if anyone can

        • Why are bounce/error emails being sent to info@ instead of contact@?

          I have my Zoho Mail and WordPress site configured so that normal website emails should go to contact@hybridbatteryservice.com. However, I keep receiving technical bounce/error emails and delivery failure notifications at info@hybridbatteryservice.com

        • I want to create a gaming website

          Hi, I wanted to ask if it's possible to build a custom website using Zoho? I would like to create a website similar to https://busimulatorultimateapk.com/ with almost the same features, functionality, and user experience. I'm not looking for an exact

        • Do Not Disturb status not respected when Cliq bar is enabled across Zoho apps

          Hi Zoho Cliq team, I want to report what appears to be a bug with how the Do Not Disturb status interacts with the embedded Cliq bar in other Zoho apps. **Issue:** When my Cliq status is set to Do Not Disturb, I continue to receive notification tones

        • Introducing the Employee Portal for internal job posting

          Employee referrals and internal applications are one of the most trusted hiring channels. But in many organizations, employees only hear about openings through messages, word of mouth, or after the role has already been open for a while. When employees

        • Zoho Webinar Summer Broadcast 2026

          What if your webinar platform could connect directly with your business tools, automate routine tasks, trigger actions across your workflows, and support every stage of your webinar lifecycle? That’s the question we’ve been answering so far this year.

        • Zoho CRM Layout Rules: Nine New Actions, Profile-Based Execution, and Interactive Preview

          Hello everyone, Availability: This feature is now available for customers in the JP and SA DCs. It is planned to be released for other customers in soon. We’re excited to announce powerful new enhancements to Layout Rules in Zoho CRM - a feature built

        • Invalid request when trying to access Mail

          When I click on the red button to access Zoho Mail at https://mail.zoho.com/zm/, I get a big yellow warning triangle with "invlid request, The input passed is invalid or the URL is invoked without valid parameters. Please check your input and try ag

        • Whats the average response time for ticket submitted?

          I submitted a request to unblock my mail accounts. They seem to be blocked for outgoing mail, and I have been waiting for days to have this fixed with no reply. I have submitted 2 tickets and an email. My work has to completely stop. I pay for the service

        • All new Address Field in Zoho CRM: maintain structured and accurate address inputs

          Availability Update: 29 September 2025: It's currently available for all new sign-ups and for existing Zoho CRM orgs which are in the Professional edition exclusively for IN DC users. 2 March 2026: Available to users in all DCs except US and EU DC. 24

        • Is there any way to have Dataprep ingest RSS?

          As stated by the title. Does the Zoho environment offer tools that I can use to, directly or using workarounds, have Dataprep ingest an RSS feed? Thanks

        • Introducing Color Coding of Picklist Values

          Dear Everyone, Greetings!! Zoho CRM is uplifting the user experience. Recently, we had some notable aesthetic improvements in CRM like Kanban View UI enhancement, New List view UI enhancement, color coding of tags, and color coding of picklists in meetings.

        • Important updates to your Widget JS APIs

          Hello everyone, Greetings from Zoho Creator! This is an urgent notice for developers and Partners who use widgets in their Zoho Creator applications. We previously announced an update to the CDN URLs used for loading the Widget JS API, with a deadline

        • Deluge sendmail in Zoho Desk schedule can't send email from a verified email address

          I am trying to add a scheduled action with ZDesk using a Deluge function that sends a weekly email to specific ticket client contacts I've already verified the email address for use in ZDesk, but sendmail won't allow it in its "from:" clause. I've attached

        • Mailbox delegation “Send As” error

          I believe there may be an issue with mailbox delegation. When I create a delegation from the Admin Console, it works correctly if I select Read permissions. However, if I select Send As permission for the delegated user, I immediately receive the following

        • Restrict Zoho Cliq Webinars and Announcements to Admins Only

          Hi Zoho Team, We hope you're doing well. We would like to raise a feature request regarding in-app announcements in Zoho Cliq, such as the recent webinar popup about the Cliq Developer Platform: While these announcements are useful, they are not always

        • how do i get mail.mydomain.com to point to zoho mail web-mail?

          I have started using zohomail, and am loving it. With my previous provider, I used to go to mail.mydomain.com, and it would take me to my webmail. I am not able to find the mapping for zoho's webmail to map to it. It is difficult to go to webmail with

        • Number of decimal places

          Hi Latha, I have added the following three fields to the Company module. Currently, these fields only allow a maximum of 2 decimal places. However, for some of our requirements, we need to enter values with up to 10 decimal places. Could you please help

        • zoho imap connection stopped working 05/28 12pm EST

          Hi, beginning Thursday, 5/28, ~12 pm est imap to siteground stopped working. When I tried to reconnect the account, connection was failing with the following message: Unable to connect SMTP server:gvam1107.siteground.biz, Port: 587. I did notice that

        • Next Page