Hello,
We develop a kintone plugin that integrates with Box using the OAuth 2.0 authorization code flow
(https://account.box.com/api/oauth2/authorize).
Recently, without any change on our side, users started seeing the following error page from Box
right after being redirected to the authorize URL:
Application Error
It looks like there's a problem with this application. ...
Error: invalid_request
■ What we found
Our `state` parameter was an encrypted, hex-encoded string of about 1,250–1,310 characters.
We tested the authorize endpoint with the same client_id and redirect_uri, changing only the
length of `state` (hex characters, no special characters):
- state length <= 1,024 characters : the normal Box login page is shown
- state length >= 1,025 characters : "invalid_request"
The result was the same in repeated tests (3 times each around the boundary).
Our `state` has been longer than 1,024 characters since we introduced it in May 2026.
We have confirmed that authorization with the same request (including a `state` of over
1,024 characters) was still working until the end of October 2026, and we have not changed
the request since the end of September 2026. The error started appearing in early November 2026,
so it seems a length limit on `state` was introduced or tightened on the Box side
between the end of October and early November 2026.
We have already worked around it by shortening `state` to about 580 characters,
and authorization works again.
■ Questions
1. Is there an official maximum length for the `state` parameter on /oauth2/authorize?
Is 1,024 characters the intended limit?
2. Was this limit introduced or changed recently? If so, is there an announcement or changelog?
■ How to reproduce
Open the following URL in a browser (replace YOUR_CLIENT_ID and YOUR_REDIRECT_URI
with values registered for your app):
https://account.box.com/api/oauth2/authorize?response_type=code&client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&state=<1,025 characters>
With a state of 1,024 characters, the login page is displayed.
Thank you in advance for your help.