Bug: OAuth 2.0 State Parameter fails with Pipe Delimiters (RFC 6749 Non-Compliance)

Bug: OAuth 2.0 State Parameter fails with Pipe Delimiters (RFC 6749 Non-Compliance)

I've discovered a bug in how Zoho's API Console handles the OAuth 2.0 authorization flow when the state parameter contains pipe characters (|), and I'm hoping the Zoho team can address this in a future update.
The Issue
Zoho's OAuth 2.0 implementation for server-based client applications uses the standard authorization endpoint: 
https://accounts.zoho.com/oauth/v2/auth?response_type=code
    &client_id=<client_id>
    &scope=<scope>
    &redirect_uri=<redirect_uri>
    &access_type=offline
    &state=<state_value>
While Zoho's documentation does not explicitly list the state parameter, it is a standard part of the OAuth 2.0 specification (RFC 6749 Section 4.1.1) and is widely used for CSRF protection and maintaining application state through the authorization flow.
However, when the state parameter contains pipe characters (|), Zoho's authorization server fails to process the request correctly, preventing users from authorizing the connection. This occurs whether the pipe characters are URL-encoded (%7C) or left unencoded.
The Problem
The pipe character is a standard delimiter in multi-part state values, particularly when passing a combination of a CSRF token and a return URL. This behavior—failing on both encoded and unencoded pipe characters—is often indicative of overly restrictive input validation or a "leaky" WAF/Proxy layer that decodes parameters before the application logic can handle them.
State Value As Sent in URL Result
abc123xyz state=abc123xyz ✓ Works correctly
session_12345 state=session_12345 ✓ Works correctly
user|action|timestamp state=user|action|timestamp
(unencoded pipes)		 ✗ Authorization fails
user|action|timestamp state=user%7Caction%7Ctimestamp
(URL-encoded pipes)		 ✗ Authorization fails
user:action:timestamp state=user%3Aaction%3Atimestamp ? Not tested
Note: Pipe characters cause failures whether URL-encoded or not. Other special characters/delimiters have not been tested and may or may not exhibit similar issues.
RFC 6749 Compliance Issue
Section 4.1.1 - Authorization Request:
"state: RECOMMENDED. An opaque value used by the client to maintain state between the request and callback."
Section 4.1.2 - Authorization Response:
"state: REQUIRED if the 'state' parameter was present in the client authorization request. The exact value received from the client."
The RFC explicitly defines the state parameter as an opaque value. This means:
  • The Authorization Server should not be looking "inside" or parsing the string at all
  • The state value must pass through the authorization process unchanged
  • Any URL-encoded characters should be handled transparently
  • The exact value received must be returned to the client in the redirect
Key Point: By definition, an "opaque" parameter means the authorization server must treat it as a data blob—accepting it, storing it, and returning it without any interpretation or transformation.
Current Behavior vs Expected Behavior
Current Behavior Expected Behavior (Per RFC 6749)
1. Client sends: state=user|action|123
(or state=user%7Caction%7C123)
2. Zoho fails to parse the state parameter
3. Authorization server returns HTTP 400 Bad Request
4. User cannot authorize the connection 		1. Client sends: state=user|action|123

2. Zoho treats state as opaque data blob
3. User authorizes the connection
4. Redirect includes the exact value received:
state=user|action|123
(or consistently encoded as sent)
The Current Workaround (Suboptimal)
Important: The workarounds below only apply if you have control over the client application generating the OAuth request. If you're integrating with a third-party application that sets the state parameter (e.g., integration platforms, SaaS tools, enterprise software), you have no ability to modify the state value and therefore no workaround is available. You are completely blocked from completing the OAuth flow.
For developers who do control the client application, you must avoid pipe characters entirely: 
// Instead of using pipes as delimiters:
state = csrf_token + "|" + user_id + "|" + redirect_path;
// ❌ This breaks Zoho's authorization flow

// Developers must use alternative approaches:
state = csrf_token + "_SEP_" + user_id + "_SEP_" + redirect_path;
// or
state = base64_encode(json_encode({"csrf": token, "user": id, "path": path}));
// or
state = csrf_token; // Store other data server-side keyed by CSRF token
Problems with these workarounds:
  • Requires refactoring existing codebases that use pipe delimiters
  • Base64 encoding increases state parameter length significantly, risking URL length limits (particularly in older browsers and some enterprise proxies which enforce ~2000 character limits)
  • Server-side storage approach adds complexity, database overhead, and potential race conditions
  • Inconsistent with how the same code works with other OAuth providers (Google, Microsoft, etc.)
  • Developers may not discover this issue until production deployment
  • Custom delimiters (like _SEP_) are non-standard and may conflict with actual data values
What Should Happen Instead
Proposed Solution:
Zoho's authorization server should properly handle URL-encoded pipe characters (%7C) in the state parameter, as required by RFC 6749. The state value must be treated as an opaque data blob.
Technical Requirement: Treat state as a Data Blob
1. Input Accept %7C (and other encoded characters) as valid parts of the query string without triggering validation errors or WAF rules
2. Persistence Store the string exactly as received during the user's login/consent session—do not decode, parse, or transform
3. Output Append the exact string back to the redirect_uri without additional transformations that might strip or corrupt the delimiters
This approach:
  • Complies with RFC 6749's requirement to return "the exact value received"
  • Follows the same behavior as other major OAuth providers
  • Requires no changes from client applications
  • Unblocks third-party integrations that cannot modify their state format
Real-World Impact
This limitation affects any integration where:
  • Third-party applications set the state parameter and cannot be modified (integration platforms, SaaS connectors, enterprise software)
  • Multi-tenant applications need to encode tenant ID and return URL in state
  • CSRF protection implementations combine security tokens with application state
  • Single Sign-On flows need to preserve original request context
  • Migration projects from other OAuth providers that used pipe delimiters

Critical Blocker: When the state parameter originates from a third-party system outside your control, there is no workaround available. The integration is completely impossible until this is fixed.

Security Note: The state parameter is critical for CSRF protection in OAuth flows. Forcing developers to change their state encoding approach may inadvertently introduce security vulnerabilities if not handled carefully.

Request to Zoho Team

Can this be addressed in a future update?

This is a standards compliance issue that impacts developers integrating with Zoho's API. For those who control their client application, the current implementation forces unnecessary workarounds. For those integrating third-party applications, the situation is worse:

1. Custom development
Refactor code to avoid pipe characters, creating Zoho-specific OAuth handling 		2. Third-party integrations
No workaround possible - integration is completely blocked

Users should not be blocked from integrating with Zoho due to non-standard OAuth implementation.

Community Input Requested: Has anyone else encountered this issue? Are there other special characters that cause similar problems with Zoho's OAuth implementation?

    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

    Nederlandse Hulpbronnen


      • Recent Topics

      • What's New in Zoho Inventory | April & May 2026

        Hello users, We're excited to roll out the latest Zoho Inventory updates for April and May 2026. These enhancements are designed to make your daily operations smoother and more efficient, from advanced inventory management and flexible pricing to automated

      • Ability to Use Both AND and OR When Creating Rules (Advanced Conditions)

        I'd like to be able to use more complicated logic when setting up rules. E.g. in Zoho Mail, I can choose "Advanced conditions (AND/OR) to create a rule that can be applied to multiple subject lines from the same sender. But in Zoho TeamInbox, I will have

      • "Make online" not clearing previously downloaded files from disk

        I downloaded a large folder via "Make offline" so I could copy it to another location. This worked. When I was done I hoped that "Make online" would restore it to the previous state where those files are not stored locally in TrueSync. This did not work—Finder

      • Permission Denied for Worklogs URL

        We're attempting to pull worklogs data from service desk plus and when using the below URL we are met with a message stating we do not have permission. https://sdpondemand.manageengine.com/api/v3/requests/xxxxxx/worklogs/ We used SDPOnDemand.requests.ALL

      • Anyone in Australia using Zoho Books AND has their account with NAB?

        Hi I have an account with both NAB and Suncorp. Suncorp transaction come in the next day however NAB transactions take 4-5 business days to appear. eg: A deposit made today in my Suncorp will be imported into Zoho tomorrow. A deposit made today to the NAB account will be imported maybe Saturday (Friday overnight). I have contacted both Zoho and NAB but noone seems to know why. I was just wondering if anyone else in Australia uses NAB and has this issue (or doesn't) maybe we could compare notes and

      • Partner with HDFC And Sbi Bank.

        Hdfc and sbi both are very popular bank if zoho books become partner with this banks then many of the zoho books users will benefit premium features of partnered banks.

      • #12 Never Leave a Billable Hour Behind

        A client approves a website redesign project. The estimated effort? 40 hours. The project is going well. A few additional review meetings are scheduled. Several rounds of content changes are requested. A few "quick fixes" get added along the way. The

      • Close task on Completion Date entry

        This discussion is similar to my issue: "backdated-task-completion-date" discussion Scenario: A bunch of tasks have been completed. But, they have not been closed. Time goes by You finally get around to closing those tasks Projects assigns the date the

      • Can I add Conditional merge tags on my Templates?

        Hi I was wondering if I can use Conditional Mail Merge tags inside my Email templates/Quotes etc within the CRM? In spanish and in our business we use gender and academic degree salutations , ie: Dr., Dra., Sr., Srta., so the beginning of an email / letter

      • Records from ATE 29: Knowledge Base, Community, and AI for smarter User Education

        Hi Everyone, "Ask the Experts 29" was an engaging session, where we explored how to utilize the Knowledge Base for customers and internal teams, as well as emphasizing the importance of our Community. This post highlights the questions and use cases discussed,

      • Deleted User Emails

        I need to delete a user as I need to re-use their license, but I'd like to keep all their emails that are attached to various contacts in the CRM. Their emails are hosted externally on an M365 license. Anyone any idea how best to engineer this? TIA

      • Its 2022, can our customers log into CRM on their mobiles? Zoho Response: Maybe Later

        I am a long time Zoho CRM user. I have just started using the client portal feature. On the plus side I have found it very fast and very easy (for someone used to the CRM config) to set up a subset of module views that make a potentially extremely useful

      • Zoho CRM upload files error

        Since today, we have been experiencing issues with uploading photos to opportunities. The message indicates that the storage is full, but as far as I can see, there is still plenty of space available. Could there be an issue or a bug?

      • Kaizen #246 - Incoming Lead Email Intent Detection using Zia Assistant API in Zoho CRM

        Hello all! Welcome back to a fresh Kaizen week. In this post, we will explore how Zia detects positive intent from incoming emails in the Leads module using the Zia Assistant API along with Workflow Rules and Custom Functions in Zoho CRM. Use Case Problem

      • Smart URL Determination

        I would like to see Vault implement some sort of "smart" URL determination. When one starts to add a new username-password combination from a new site, Vault brings in the exact URL of the page from which this is happening. All too often, it looks something

      • Removing To or CC Addresses from Desk Ticket

        I was hoping i could find a way to remove unnecessary email addresses from tickets submitted via email. For example, a customer may email the support address AND others who are in the helpdesk notification group, in either the TO or CC address. This results

      • Tip #76- Exploring Technician Console: Quick Launch- 'Insider Insights'

        Hello Zoho Assist Community! Welcome back to our Technician Console series. Last time we explored Power Options, and this time we are turning the spotlight on a feature that quietly saves you dozens of clicks in every session by getting you exactly where

      • Multi-Book Accounting Support in Zoho Books

        Currently, businesses that operate multiple entities, regions, or divisions need to maintain separate Zoho Books instances or resort to manual consolidation processes. This creates significant operational friction and increases the risk of errors. PROBLEM:

      • Automated Multi-Subsidiary Consolidation Engine in Zoho Books

        For organizations managing multiple subsidiaries across different geographies or business units, consolidation is a quarterly/annual nightmare. Zoho Books lacks native consolidation tools, forcing companies to export data, manipulate it in Excel, and

      • Zoho Books | Product updates | April 2026

        Hello users, Welcome to our April 2026 product updates roundup! Highlights include profit margin for sales transactions, insights in reports, recording deposits from undeposited funds in banking, and faster production workflows with improved assembly

      • Unable to charge GST on shipping/packing & Forwarding charges in INDIA

        Currently, tax rates only apply to items. It does not apply tax to any shipping or packing & forwarding charges that may be on the order as well. However, these charges are taxable under GST in India. Please add the ability to apply tax to these charges.

      • How to add packing & forwarding charge in purchase order & quotation???

        Hello Zoho Team I have just started using Zoho for my company and I wanted to make purchase order. My supplier charges fix 2% as packing & forwarding on Total amount of material and then they charge me tax. For example, Material 1 = 100 Rs Material 2

      • How to book GST paid in zoho books

        hi, i am a new user to Zoho books and not able to book GST paid in books, kindly suggest how i can book it in books. thanks, siddharth

      • [Bug] WebAuthn passkey registration blocked on rpIds with TLDs longer than 6 characters (.accountant, .technology, etc.) — isValidDomain regex too strict

        Hi, Filing on behalf of an enterprise customer where Zoho Vault is deployed across the company. The Chrome extension blocks WebAuthn passkey registration on legitimate sites whose Relying Party ID (rpId) has a TLD longer than 6 letters. This affects every

      • Zoho Payroll: Product Updates - H1, 2026

        Over the last few months, Zoho Payroll has added updates that make payroll easier to process, review, explain, and manage for businesses. The most important improvements focus on payroll flexibility, gratuity tracking, employee self-service, reporting,

      • Pushover Notification Module

        Hello, it would be good if there would be a "Pushover" (https://pushover.net/) module besides the standard SMS module. Pushover is now very well known, especially in IT, and is becoming more and more popular. The biggest advantage are the customizable

      • E-Mail Blacklist via GUI

        Hello, It would be helpful if the GUI included an option to block specific email addresses (both incoming and outgoing). I want a setting where I can completely block certain email addresses. This means that no tickets can be opened from those addresses,

      • How to migrate cpanel mail to new zoho mail?

        Hi, I have a client whose email (for his website domain) is currently on "cpanel mail". Now client wants to move to Zoho Mail. I checked migration docs and its mentioned that I can migrate using IMAP or POP but I am not getting exactly what steps should I follow in order to achieve this. As soon I will add clients domain and setup MX Records and SPF for that, I will lose access to currently setup email (cpanel mail) and without adding domain in zoho mail, I can't setup email for that. Sorry if I

      • SalesIQ Integration with LINE: API Rate Limit Issue and Pre-Chat Flow Concerns

        Hello SalesIQ Developer Team. I have investigated the issue and found that the LINE Rate Limit is being consumed unusually quickly. LINE API free usage limit: 300 messages per month per brand. This limit will be reached within the first few days. 1. LINE

      • How to Backup Zoho to PST?

        I'm looking for a simple way to backup Zoho Mail emails to PST format. I tried the IMAP method with Outlook, but it seems slow and complicated for large mailboxes. I need a solution that can: Export Zoho emails to PST Preserve attachments and folder hierarchy

      • Warehouse -> Locations Transition Causing Errors

        After saying "okay" to the transition from 'warehouses' to 'locations', I've now got shipped Sales Orders that I cannot invoice. How does one proceed?

      • Zoho CRM Community Digest - May 2026 | Part 1

        Hello Everyone! This edition introduces the new centralized Zoho Announcements Hub, a single dashboard designed to let you track and filter live product roll-outs from across the Zoho ecosystem. Alongside the Announcements Hub, this month also features

      • SalesIQ : How to disable markdown autoformatting?

        Hello Is there setting to disable "Markdown Text" this feature and enter raw markdown in plain text only format it after you send the message? Thanks

      • Converting XML to JSON

        Hi! I need to convert a variable in XML to JSON. Can i do it without using an API on deluge? I looked into the documentation but couldn't get any answers to this. Thank you in advance!

      • 元問い合わせメールに返信したときの統合処理

        ワークフロー作成したので備忘録です。 Zoho Desk で作成したメールアドレス宛てに既存のメールアドレスにきた問合せ先メールを転送してチケット作成を行っています。 元の問い合わせメールに返信、転送した際にRe,RE,re,Fw,FW,fwが件名の頭に付くため、その度に新規起票が乱立します。 メールの頭にRe,RE,re,Fw,FW,fwがある時それを除いた件名と同じ件名が既にチケット作成されていれば統合するワークフローを作成しました。 条件が緩いので既存チケットの検索で完了済みや5日以上前に作成したものは除いてもいいとは思います。

      • Marketing Automation Demo Video

        I would like to see a video demo for Marketing Automation.  Do you have one statashed away somewhere?

      • is it possible to add more than one Whatsapp Phone Number to be integrated to Zoho CRM?

        so I have successfully added one Whatsapp number like this from this User Interface it seems I can't add a new Whatsapp Number. I need to add a new Whatsapp Number so I can control the lead assignment if a chat sent to Whatsapp Phone Number 1 then assign

      • Supervisor Rules --> Custom Function

        Hello, currently I can't add a custom function to a supervise rule. Is there a reason for this? Background: We have BluePrint managed tickets and actually we have a Supervise rule which should set the ticket to "closed" after 168 hours since the last

      • Automate Backups

        This is a feature request. Consider adding an auto backup feature. Where when you turn it on, it will auto backup on the 15-day schedule. For additional consideration, allow for the export of module data via API calls. Thank you for your consideration.

      • How to record GST amount for Value of Service on Inward remittance charged by bank

        Hi please advice I have a situation.    1. I have HDFC bank account 2. I have a customer who has done inward remittance for purcahses from overseas. 3. HDFC is showing Value of Service say $100 and GST @ 18%. 4. Value of Service is not charged. But  CGST

      • Next Page