diff --git a/openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java b/openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java
index 503ef6e434..188fcd5eac 100644
--- a/openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java
+++ b/openid/src/main/java/org/springframework/security/openid/OpenIDAuthenticationFilter.java
@@ -188,37 +188,31 @@ public class OpenIDAuthenticationFilter extends AbstractAuthenticationProcessing
* @return The return_to URL.
*/
protected String buildReturnToUrl(HttpServletRequest request) {
- try {
- StringBuffer sb = request.getRequestURL();
-
- Iterator iterator = returnToUrlParameters.iterator();
- boolean isFirst = true;
-
- while (iterator.hasNext()) {
- String name = iterator.next();
- // Assume for simplicity that there is only one value
- String value = request.getParameter(name);
-
- if (value == null) {
- continue;
- }
-
- if (isFirst) {
- sb.append("?");
- isFirst = false;
- }
- sb.append(URLEncoder.encode(name, "UTF-8")).append("=").append(URLEncoder.encode(value, "UTF-8"));
-
- if (iterator.hasNext()) {
- sb.append("&");
- }
+ StringBuffer sb = request.getRequestURL();
+
+ Iterator iterator = returnToUrlParameters.iterator();
+ boolean isFirst = true;
+
+ while (iterator.hasNext()) {
+ String name = iterator.next();
+ // Assume for simplicity that there is only one value
+ String value = request.getParameter(name);
+
+ if (value == null) {
+ continue;
+ }
+
+ if (isFirst) {
+ sb.append("?");
+ isFirst = false;
+ }
+ sb.append(utf8UrlEncode(name)).append("=").append(utf8UrlEncode(value));
+
+ if (iterator.hasNext()) {
+ sb.append("&");
}
- return sb.toString();
- } catch(UnsupportedEncodingException e) {
- Error err = new AssertionError("The Java platform guarantees UTF-8 support, but it seemingly is not present.");
- err.initCause(e);
- throw err;
}
+ return sb.toString();
}
/**
@@ -276,4 +270,20 @@ public class OpenIDAuthenticationFilter extends AbstractAuthenticationProcessing
Assert.notNull(returnToUrlParameters, "returnToUrlParameters cannot be null");
this.returnToUrlParameters = returnToUrlParameters;
}
+
+ /**
+ * Performs URL encoding with UTF-8
+ *
+ * @param value the value to URL encode
+ * @return the encoded value
+ */
+ private String utf8UrlEncode(String value) {
+ try {
+ return URLEncoder.encode(value, "UTF-8");
+ } catch(UnsupportedEncodingException e) {
+ Error err = new AssertionError("The Java platform guarantees UTF-8 support, but it seemingly is not present.");
+ err.initCause(e);
+ throw err;
+ }
+ }
}