# User API keys: payload and existing query string leads to a double question mark

**URL:** <https://meta.discourse.org/t/user-api-keys-payload-and-existing-query-string-leads-to-a-double-question-mark/123617>\
**Category:** Bug\
**Created:** [July 22, 2019, 10:55am UTC](https://meta.discourse.org/t/user-api-keys-payload-and-existing-query-string-leads-to-a-double-question-mark/123617 "2019-07-22T10:55:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![blattersturm](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blattersturm/32/76134_2.png) [@blattersturm](https://meta.discourse.org/u/blattersturm)\
**Post date:** [July 22, 2019, 10:55am UTC](https://meta.discourse.org/t/user-api-keys-payload-and-existing-query-string-leads-to-a-double-question-mark/123617/1 "2019-07-22T10:55:40Z")

</div>

If I call `user-api-key/new` with an `auth_redirect` already containing a query string (e.g. `http://localhost:30120/auth-discourse?state=BASE64`), I end up with a redirect URI along the likes of `http://localhost:30120/auth-discourse?state=BASE64?payload=PAYLOAD` - two query strings, and no `&` appending.

> <https://github.com/discourse/discourse/blob/888e68a1637ca784a7bf51a6bbb524dcf7413b13/app/controllers/user_api_keys_controller.rb#L96>

This code might need to be changed to check if there’s already a query string in the URI, or perhaps use some URI builder?

---

<div class="post-metadata">

**Author:** ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)\
**Post date:** [July 22, 2019, 1:41pm UTC](https://meta.discourse.org/t/user-api-keys-payload-and-existing-query-string-leads-to-a-double-question-mark/123617/2 "2019-07-22T13:41:31Z")

</div>

It does seem like the assumption the code makes is that it doesn’t already contain any query parameters. We’d be open to a PR to fix this.

---

<div class="post-metadata">

**Author:** ![saurabhp](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/saurabhp/32/125182_2.png) [@saurabhp](https://meta.discourse.org/u/saurabhp)\
**Post date:** [July 23, 2019, 3:50pm UTC](https://meta.discourse.org/t/user-api-keys-payload-and-existing-query-string-leads-to-a-double-question-mark/123617/3 "2019-07-23T15:50:02Z")

</div>

I have opened PR for this issue here:  
[https://github.com/discourse/discourse/pull/7923](https://github.com/discourse/discourse/pull/7923)

---

<div class="post-metadata">

**Author:** ![saurabhp](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/saurabhp/32/125182_2.png) [@saurabhp](https://meta.discourse.org/u/saurabhp)\
**Post date:** [July 24, 2019, 2:37am UTC](https://meta.discourse.org/t/user-api-keys-payload-and-existing-query-string-leads-to-a-double-question-mark/123617/4 "2019-07-24T02:37:14Z")

</div>

PR has been merged. This topic can be closed 😄

---

<div class="post-metadata">

**Author:** ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)\
**Post date:** [July 24, 2019, 3:23am UTC](https://meta.discourse.org/t/user-api-keys-payload-and-existing-query-string-leads-to-a-double-question-mark/123617/5 "2019-07-24T03:23:28Z")

</div>