<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Andreas<div><br></div><div>This has come up occasionally over the years - there is some background here: <a href="https://gitlab.com/openid/conformance-suite/-/issues/1165">https://gitlab.com/openid/conformance-suite/-/issues/1165</a></div><div><br></div><div>The short answer however is that authorization servers should accept both forms.</div><div><br></div><div>Thanks</div><div><br></div><div>Joseph</div><div><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On 25 Nov 2024, at 09:22, Andreas Faafeng <andreas@faafeng.com> wrote:</div><br class="Apple-interchange-newline"><div><div>Hi all,<br><br>I am new to OpenID so please forgive my ignorance. I find myself in a situation where two parties cannot agree on which of the following is the correct interpretation of the OpenID specification with regards to scope separator encoding:<br><br>A. scope=openid+profile+email<br>B. scope=openid%20profile%20email<br><br>The specification [1] states that "Query String Serialization" shall follow application/x-www-form-urlencoded format according to (the now out of date 2018, new link below) "HTML 4.01 Specification" [2] which in turn refers to [3], [4] which says:<br><br> "URLSearchParams objects will percent-encode anything in the application/x-www-form-urlencoded percent-encode set, and will encode U+0020 SPACE as U+002B (+)."<br><br>Am I wrong to then assume that the above option A is indeed the correct interpretation of the OpenID specification such that its example [5] is misleading or even incorrect? Can or shall both be accepted?<br><br>Thank you in advance for your time and effort.<br><br>[1] https://openid.net/specs/openid-connect-core-1_0.html#QuerySerialization<br>[2] https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#url-encoded-form-data<br>[3] https://url.spec.whatwg.org/#concept-urlencoded<br>[4] https://url.spec.whatwg.org/#example-constructing-urlsearchparams<br>[5] https://openid.net/specs/openid-connect-core-1_0.html#codeExample<br><br>-- <br>Best regards<br>Andreas<br>_______________________________________________<br>general mailing list<br>general@lists.openid.net<br>https://lists.openid.net/mailman/listinfo/openid-general<br></div></div></blockquote></div><br></div></body></html>