WASReqURLOidc cookie encodes the request url but doesn't decoded it upon successful redirection

[KingMackle]

Describe the bug
We are calling a protected URL including some query params like
/protected/resource/?name=aaaaaaaa%20aaaaaaa&description=bbbbbbb%20bbbbbbbbbb&type=CHECKLIST
The server uses OIDC. The URL in the WASReqURL cookie appears to be incorrectly encoded:
WASReqURLOidcn1674482248=https://server.com/protected/resource/?name=aaaaaaaa%252520aaaaaaa&description=bbbbbbb%252520bbbbbbbbbb&type=CHECKLIST; Expires=Mon, 16 Nov 2020 21:25:46 GMT; Path=/; Secure; HttpOnly
Note that %20 become %252520

Steps to Reproduce
Accesse a protected resource on a WLP server that uses OIDC
Request 1:
GET /protected/resource/?name=aaaaaaaa%20aaaaaaa&description=bbbbbbb%20bbbbbbbbbb&type=CHECKLIST HTTP/1.1

Response 1:
HTTP/1.1 302 Found
Location: https://server.com/oidc/endpoint/ums/authorize?response_type=code&client_id=client&state=001605561526461ZdjsBdS3i&redirect_uri=https%3A%2F%2Fserver.com%3A9443%2Foidcclient%2Fredirect%2FumsClient&scope=openid+profile+email
Set-Cookie:
WASReqURLOidcn1674482248=https://server.com/protected/resource/?name=aaaaaaaa%252520aaaaaaa&description=bbbbbbb%252520bbbbbbbbbb&type=CHECKLIST; Expires=Mon, 16 Nov 2020 21:25:46 GMT; Path=/; Secure; HttpOnly

Request 2:
GET
https://server.com/oidc/endpoint/ums/authorize?response_type=code&client_id=client&state=001605561526461ZdjsBdS3i&redirect_uri=https%3A%2F%2Fserver.com%3A9443%2Foidcclient%2Fredirect%2FumsClient&scope=openid+profile+email

Response 2:
HTTP/1.1 302
Location:
https://server.com/oidcclient/redirect/umsClient?session_state=8QI1st1xwaqMMD4HexvAblXcVxxAZBQKhAbY2TBTwBE%3D.656677c4b074&code=CIxsvDu7RGVNYNHufIlB28r5vVFkZt&state=001605561526461ZdjsBdS3i

Request 3:
GET /oidcclient/redirect/umsClient?session_state=8QI1st1xwaqMMD4HexvAblXcVxxAZBQKhAbY2TBTwBE%3D.656677c4b074&code=CIxsvDu7RGVNYNHufIlB28r5vVFkZt&state=001605561526461ZdjsBd

Response 3:
HTTP/1.1 302 Found
Location: https://server.com/protected/resource/?name=aaaaaaaa%252520aaaaaaa&description=bbbbbbb%252520bbbbbbbbbb&type=CHECKLIST

Request 4:
GET /protected/resource/?name=aaaaaaaa%252520aaaaaaa&description=bbbbbbb%252520bbbbbbbbbb&type=CHECKLIST HTTP/1.1

Expected behavior
Expect the URL query params to be decoded upon successful redirection

Diagnostic information:

• OpenLiberty Version: WLP 20.0.0.9.
• Java Version:

java version "1.8.0_231"
Java(TM) SE Runtime Environment (build 8.0.6.0 - pwa6480sr6-20191107_01(SR6))
IBM J9 VM (build 2.9, JRE 1.8.0 Windows 10 amd64-64-Bit Compressed References 20191106_432135 (JIT enabled, AOT enabled)
OpenJ9   - f0b6be7
OMR      - 18d8f94
IBM      - 233dfb5)
JCL - 20191016_01 based on Oracle jdk8u231-b1

[teddyjtorres]

We agree it is a bug. Accepting it into our backlog.

[teddyjtorres]

Please determine if you can use

<openidConnectClient isClientSideRedirectSupported="true" />

to have the cookie created at the browser side as a work around for that scenario.