# عناوين البريد الإلكتروني وSSO التي تحتوي على علامة زائد

**URL:** <https://meta.discourse.org/t/sso-and-e-mail-addresses-having-a-plus-sign/98481>\
**Category:** Support\
**Created:** [1 أكتوبر 2018، 1:39م UTC](https://meta.discourse.org/t/sso-and-e-mail-addresses-having-a-plus-sign/98481 "2018-10-01T13:39:20Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![thabbs](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/thabbs/32/82150_2.png) [@thabbs](https://meta.discourse.org/u/thabbs)\
**Post date:** [1 أكتوبر 2018، 1:39م UTC](https://meta.discourse.org/t/sso-and-e-mail-addresses-having-a-plus-sign/98481/1 "2018-10-01T13:39:21Z")

</div>

I’m not sure if this is an implementation error on my side or if this is a bug in the SSO implementation of Discourse.  
Users having a plus-extension in the local part of their e-mail address got an error since Discourse interpretes the plus sign as space.

Following [Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/official-single-sign-on-for-discourse-sso/13045) I must not urlencode the payload before encoding it to base64.

Here my basic implementation, written in php:

```
$email = 'user+extension@example.com';
$payload = base64_encode($nonce. "&email={$email}&external_id={$external_id}&username={$realname}&name={$realname}");
$return_sig = hash_hmac('sha256', $payload, $token);
header("Location: $referer/session/sso_login?sso=". rawurlencode($payload) ."&sig=". $return_sig);

```

Discourse throws the error: “Nonce has already expired” and writes down the e-mail address as “user [extension@example.com](mailto:extension@example.com)” with a space instead of a plus sign.

---

_[View the full topic](https://meta.discourse.org/t/sso-and-e-mail-addresses-having-a-plus-sign/98481)._