Repository navigation
OIDC ON ZOHO #1466
Description
Introduction
Hello, i have a problem with the oidc provider Zoho
I created correctly the application and configured Sqlpage.
when i try to open the site, the url for call the oidc provider contains a nonce with argon2.
I think that the issue is caused by the nonce parameter generated by sqlpage. this:nonce=$argon2id$v=19$m=8,t=1,p=1$...
Zoho's servers reject any authentication URL where the nonce parameter contains special characters like dollar signs ($), equal signs (=), or commas (,). It misinterprets these characters as a malformed query string and drops the request.If you manually intercept the URL, strip out the Argon2id syntax, and replace it with a plain alphanumeric string (e.g., &nonce=12345), the Zoho login page loads successfully.
After sqlpage oidc_callback page: The identity provider returned an invalid ID token
To Reproduce
config oidc both on zoho api developer and sqlpage.
Actual behavior
Open website
Zoho error page
Expected behavior
Open website
Redirect to login
Back to website
Version information
- OS: debian13
- Database MSSQL
- SQLPage Version 0.46.2
Activity
lovasoa commentedon Sep 17, 2026
Thanks for reporting this ! I investigated a bit and found this old report online https://groups.google.com/g/keycloak-user/c/hKOhAQS3wp8
It looks like zoho implemented the oidc specification incorrectly ? Did you try reporting it to them ?
If you want to help getting to the bottom of this, you could paste .har network captures to show the interaction ? Using a test account
sarz4fun commentedon Sep 17, 2026
I studied the case.
Zoho's waf rejects all nonce with any special characters in url to prevent sql injections or xss.
sqlpage uses argon2 that add unencoded $ in nonce.
It is not a sql-page bug, but a wrong implemetation of oidc by zoho.
https://www.zoho.com/crm/help/api/security-enhancement.html
I don't know if you want to add some workaround or leave as is.
lovasoa commentedon Sep 17, 2026
Zoho’s OIDC authorization endpoint rejects valid nonce string values containing
=, despite correct URL encoding. This conflicts with OIDC Core’s requirement that nonce values be passed through unmodified and its recommendation that providers perform no other processing on them.We reproduced this with a test client and are working on a compatibility fix.
sarz4fun commentedon Sep 17, 2026
Wow.
Thank you so much.
lovasoa commentedon Sep 17, 2026
Screencast.From.2026-09-17.22-35-44.mp4
I'll close this as a part of #1468 . Thanks for reporting :)