Okta returns a 400 Bad Request error during OpenID Connect (OIDC) authorization requests when non-ASCII characters exist in cookie values. Resolving this issue requires clearing the browser cookies or removing the non-ASCII characters from the client application that is setting the cookies. When attempting an authorization request, the browser displays the following error:

400 Bad Request

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Authorization Requests
• Cookies

The client application or browser saves non-ASCII characters in the cookie values. Non-ASCII characters include letters with accents or diacritics (such as é, ñ, ü) common in languages like Spanish, French, and German, as well as characters from non-Latin scripts like Cyrillic, Arabic, Chinese, or Japanese.

The Request for Comments (RFC) 6265 specification for cookies strictly disallows non-ASCII characters. When Okta processes the authorization request containing these invalid characters, Okta generates a 400 Bad Request error.

What steps resolve the "400 Bad Request" error caused by non-ASCII characters in cookies?

Clear the browser cookies or modify the client application code to ensure only ASCII characters populate the cookie values by performing the following actions.

1. Identify the client application or domain setting the cookie with non-ASCII characters.
2. Clear the cookies for the affected domain within the web browser settings.
3. Modify the client application source code to encode cookie values or restrict cookie values to ASCII characters only, ensuring compliance with the RFC 6265 specification.
4. Initiate a new authorization request to verify that Okta processes the request successfully.

Related References

• Authorization Requests
• RFC 6265 Specification