How to Fix Double-Encoded URLs and Nested Redirect Parameter Corruption

The Anatomy of the %2520 Bug

In percent-encoding, the percent character `%` itself has the hexadecimal ASCII code **`%25`**.

If a URL contains an encoded space: ```text https://example.com/user%20profile ``` And an application or reverse proxy (e.g., Nginx, AWS API Gateway, or a client HTTP interceptor) passes the string into `encodeURIComponent` a second time, the parser encodes the `%` character: ```text https://example.com/user%2520profile ``` The downstream server decodes only the outer layer, receiving the literal string `"user%20profile"` rather than `"user profile"`, which can break route handlers and query parameters.

Common In OAuth Redirect Flows Double encoding frequently occurs in OAuth 2.0 and OpenID Connect flows: ```text https://auth.example.com/authorize?redirect_uri=https%3A%2F%2Fapp.com%2Fcallback%3Fplan%3Dpro ``` If the frontend encodes the entire parameter string twice, the authorization server compares `https%253A%252F%252F...` against its registered whitelist, failing with a **`redirect_uri_mismatch`** error.

Safe Normalization Function To fix double-encoded strings defensively without throwing errors on malformed sequences:

function safeDecodeFully(uri) {
  let previous = uri;
  try {
    let current = decodeURIComponent(uri);
    // Continue decoding if nested encodings remain (capping loops at 3)
    let depth = 0;
    while (current !== previous && depth < 3) {
      previous = current;
      current = decodeURIComponent(current);
      depth++;
    }
    return current;
  } catch (e) {
    return previous; // Fall back to last safe state if malformed
  }
}

Inspect, decode, and unwrap nested redirect parameters with Mickytool's **URL Encoder / Decoder**.