title: Azure Active Directory OAuth 2.0 Authorization gives Bad Request
body: <p>When requesting an authorization code, if the state url parameter has following value, <a href="https://login.microsoftonline.com/oauth2/authorize" rel="nofollow noreferrer">https://login.microsoftonline.com/oauth2/authorize</a> gives me a Bad Request. </p>
  
  <pre><code>state=%3C%3CMULE_EVENT_ID%3D0-6cadfe22-e9ea-11e6-99ff-205120524153%3E%3E
  </code></pre>
  
  <p>If I remove the encoded values: <code>&lt;&lt;</code> and <code>&gt;&gt;</code>, it works well. Currently I have some limitations and I cannot remove those values.</p>
  
  <p>In the <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code" rel="nofollow noreferrer">documentation</a> is says that "state" is a value included in the request that will also be returned in the token response. <strong>It can be a string of any content that you wish.</strong></p>