login_hint parameter with literal # character gets URL-encoded when using authorizationParams

[prajwalhn-18]

Checklist

• The issue can be reproduced in the express-openid-connect sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

I need to pass a login_hint value containing a literal # (e.g., sample#ClientId=sample) so it appears in the authorization URL unencoded, but the library URL-encodes it (%23). I would need the literal # in the query parameter.

Reproduction

1. Pass sample#ClientId=sample as login_hint in authorizationParams, this gets replaced with encoded url

Additional context

No response

express-openid-connect version

^2.19.2

Express version

4.21.2

Node.js version

20.13.1

[aks96]

Hey @prajwalhn-18 Thanks for your contribution, we will checkout the issue and update as per that.

[prajwalhn-18]

I found the issue to be in openid-client. as express-openid-connect is using version ^4.9.1, this version is using url.format in authorizationUrl https://github.com/panva/openid-client/blob/61a7743690831e42cff0e43821673973170376a6/lib/client.js#L264

I can create a patch out of this, but, this is a temporary solution, as that may lead to some other issues.

[aks96]

@prajwalhn-18 We are under going migration for openid-client from v4 to v6 likely once we go live with that version this issue will be resolved.