serialized oauth2 state may cause "Illegal base64 character" exception upon deserialization

[PeterFokkinga]

Expected Behavior

When using the serialize(State) method of JacksonStateSerDes then the OauthAuthorizationResponse should have a State property that is equal to the one we serialized.

Actual Behaviour

In some cases an IllegalArgumentException is thrown with the following stacktrace:

Unexpected error occurred: Illegal base64 character 2f
java.lang.IllegalArgumentException: Illegal base64 character 2f
	at java.base/java.util.Base64$Decoder.decode0(Base64.java:852)
	at java.base/java.util.Base64$Decoder.decode(Base64.java:570)
	at java.base/java.util.Base64$Decoder.decode(Base64.java:593)
	at io.micronaut.security.oauth2.endpoint.authorization.state.JacksonStateSerDes.deserialize(JacksonStateSerDes.java:51)
	at io.micronaut.security.oauth2.endpoint.authorization.response.StateAwareAuthorizationCallback.lambda$new$0(StateAwareAuthorizationCallback.java:43)
	at io.micronaut.core.util.SupplierUtil$1.get(SupplierUtil.java:47)
	at io.micronaut.security.oauth2.endpoint.authorization.response.StateAwareAuthorizationCallback.getState(StateAwareAuthorizationCallback.java:62)
	at io.micronaut.security.oauth2.endpoint.authorization.response.DefaultOauthAuthorizationResponseHandler.handle(DefaultOauthAuthorizationResponseHandler.java:80)

Steps To Reproduce

This test should succeed (it doesn't at the moment)

@Test
void roundtripTes() {
    var state = new DefaultState();
    state.setNonce("b8d45798-36d8-450e-8e5d-d5f56fe221df");
    state.setRedirectUri(URI.create("/ebrevet?pwa=standalone"));

    var serialized = stateSerDes.serialize(state);
    var check = stateSerDes.deserialize(serialized);

    assertNotNull(check);
    assertEquals(state.getNonce(), check.getNonce());
    assertEquals(state.getRedirectUri(), check.getRedirectUri());
}

Environment Information

• MacOS 26.4
• OpenJdk 21.0.10

Example Application

No response

Version

4.10.10

[PeterFokkinga]

Apologies, this was already reported in #2031 but that PR has been stalled for months...

I can create a new PR if the existing one by @Toseban cannot be merged. I really would like this issue to be fixed ;-)