URL encode client secret

[pdx-mikaelberg]

Microsoft-Store-Services/Microsoft.StoreServices/Microsoft.StoreServices/Authentication/AccessTokenProvider.cs

Line 103 in ff47ebc

$"&client_secret={_clientSecret}" +

It'd be a good idea to URL encode the client secret here, since there is no limitation on what characters it may contain. I used one containing the % sign and ended up getting 401s.

URL encoding the secret solved it:

    var encodedSecret = System.Web.HttpUtility.UrlEncode(_clientSecret);
    var requestBody = $"grant_type=client_credentials&client_id={_clientId}" +
                                  $"&client_secret={encodedSecret}" +
                                  $"&resource={audience}";

[CameronGoodwin]

@pdx-mikaelberg
Thank you for this feedback! I am working on some updates right now so I will work on doing this. Sorry for the long delayed response as I was occupied with other engagements and just now circling back to make some of the feedback updates.

[CameronGoodwin]

Here is what I added / updated. I thought about encoding the whole body to be safe, but decided to just go with the client secret as the other values should not have the characters that would cause issues. Then it makes the calls easier to read in Fiddler or other debugging tools.

            //  URL encode the Secret key to ensure it gets properly transmitted if containing
            //  characters such as '%'.  We just encode the secret so the rest of the body is
            //  easily read in debugging tools such as Fiddler.
            var encodedSecret = System.Web.HttpUtility.UrlEncode(_clientSecret);

            //  Build the HTTP request information to generate the access token
            var requestUri = $"https://login.microsoftonline.com/{_tenantId}/oauth2/token";
            var httpRequest = new HttpRequestMessage(HttpMethod.Post, requestUri.ToString());
            var requestBody = $"grant_type=client_credentials&client_id={_clientId}" +
                              $"&client_secret={encodedSecret}" +
                              $"&resource={audience}";
            httpRequest.Content = new StringContent(requestBody, Encoding.UTF8, "application/x-www-form-urlencoded");