# Server-side sync\_sso rejects valid payloads with 422 "Login Error" when the base64 contains a \`+\` (triggered by \`~\` in synced fields)
**URL:** https://meta.discourse.org/t/server-side-sync-sso-rejects-valid-payloads-with-422-login-error-when-the-base64-contains-a-triggered-by-in-synced-fields/407426
**Category:** Bug
**Tags:** sso, fixed
**Created:** [July 13, 2026, 7:24am UTC](https://meta.discourse.org/t/server-side-sync-sso-rejects-valid-payloads-with-422-login-error-when-the-base64-contains-a-triggered-by-in-synced-fields/407426 "2026-07-13T07:24:45Z")
**Posts on this page:** 1
**Showing post:** 3
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [July 24, 2026, 2:04pm UTC](https://meta.discourse.org/t/server-side-sync-sso-rejects-valid-payloads-with-422-login-error-when-the-base64-contains-a-triggered-by-in-synced-fields/407426/3 "2026-07-24T14:04:20Z")
Thanks for the report @sweetbeems 👍 It’ll be fixed by
>
>
> Previously, \`sync\_sso\` rebuilt its query string from the already form-decoded \`p…arams\[:sso\]\` and let \`DiscourseConnect.parse\` decode it a second time, so any literal \`+\` in the base64 payload became a space and a correctly-signed request was rejected with a generic 422 "Login Error".
>
> This change rebuilds the query with \`Rack::Utils.build\_query\` — the exact inverse of the \`parse\_query\` the parser runs — so the payload is decoded exactly once. The second commit applies the same reasoning to \`CookedPostProcessor#remove\_user\_ids\`, which rebuilt link query strings by hand and corrupted encoded values (e.g. \`%26\`) when stripping the \`u=\` param.
>
> Reported at https://meta.discourse.org/t/407426.
---
_[View the full topic](https://meta.discourse.org/t/server-side-sync-sso-rejects-valid-payloads-with-422-login-error-when-the-base64-contains-a-triggered-by-in-synced-fields/407426)._