OAuth2PushedAuthorizationRequestUri uses Base64URL encoding for the state, which can produce a value containing ___, the same sequence used as the delimiter. As a result, indexOf may locate a delimiter within the state instead of the delimiter preceding the expiration timestamp.
Use lastIndexOf to reliably locate the delimiter before the timestamp without changing the existing request URI format.
Closes gh-19444
Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
Andrey Litvitski
e4fafce066