mirror of
https://github.com/keycloak/keycloak.git
synced 2026-10-23 19:29:23 +03:00
OTPPolicy.getKeyURI built the account-name half of the otpauth:// label with URLEncoder.encode, which emits the application/x-www-form-urlencoded form where a space becomes '+'. But the label is a URI path component, in which '+' is a literal plus, not a space - so an account name such as "john doe" was rendered as "john+doe" and shown verbatim by authenticator apps (Google Authenticator, FreeOTP). Rewrite '+' to %20 for the account name, exactly as the adjacent issuerName line already does. Add a regression test asserting the account segment round-trips to "john doe". Signed-off-by: Md. Amdadul Bari Imad <amdadulbari@gmail.com>