> For the complete documentation index, see [llms.txt](https://docs.poja.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.poja.io/troubleshooting/query-parameters-unexpectedly-modified-by-api-gateway.md).

# Query Parameters Unexpectedly Modified by API Gateway

***

### The Bug <a href="#the-bug" id="the-bug"></a>

When your Spring Boot Application is behind AWS API Gateway, you might notice that some query parameters don’t arrive as expected.

| <p>Request URL</p><p><i class="fa-solid">:solid:</i></p> | <p>Observed Parameters in Spring Boot</p><p><i class="fa-solid">:solid:</i></p> |
| -------------------------------------------------------- | ------------------------------------------------------------------------------- |
| `/hello?name=john=`                                      | `[name=john]`                                                                   |
| `/hello?name=stan=ley`                                   | `[name=]`                                                                       |

In other words, parts of your parameter values are truncated. This happens even though the request seems correct when you type it in the browser, test it with a tool like Postman, or even run the application locally without API Gateway. The issue occurs **before the request reaches your application**, as API Gateway parses and modifies query parameters containing certain characters like `=`.

***

### The Solution <a href="#the-solution" id="the-solution"></a>

The most reliable way to avoid this behavior is **URL-encoding the parameter values** before they are sent to API Gateway.

For example:

| <p>Encoded Request URL</p><p><i class="fa-solid">:solid:</i></p> | <p>Observed Parameters in Spring Boot</p><p><i class="fa-solid">:solid:</i></p> |
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| `/hello?name=john%3D`                                            | `[name=john=]`                                                                  |

Key points to remember:

* Always **URL-encode query parameters** before sending them.
* When values are correctly encoded, API Gateway preserves them without modification, and the backend receives the exact value sent by the client.

{% hint style="danger" %}
Important

* **OAuth2 flows caution:** The `state` parameter can be properly URL-encoded when redirecting **to the OAuth provider**, but some providers return it **not URL-encoded**. In these cases, API Gateway may truncate `=` padding in Base64 values, causing Spring Boot to fail to find the corresponding authorization request `authorization_request_not_found`) even though it works locally.
* **Possible fixes:**
  * Generate the `state` value in a **URL-safe Base64** format to avoid `=`.       &#x20;
  * Or, detect and **correct the corrupted state parameter** in your application before processing it.       &#x20;
* Note that some OAuth providers are stricter than others and **require exact Base64 decoding**, so this issue may appear only with certain providers.
  {% endhint %}