diff --git a/phase-2/poc/auth.js b/phase-2/poc/auth.js
index 972315a..86ff106 100644
--- a/phase-2/poc/auth.js
+++ b/phase-2/poc/auth.js
@@ -47,7 +47,7 @@ http.createServer((req, res) => {
                     res.end(
                         screen2part1 + obj.humanReadable +
                         screen2part2 + clientTicket +
-                        screen2part3 + query.scope +
+                        screen2part3 + encodeURIComponent(query.scope) +
                         screen2part4
                     );
                 } catch (e) {
@@ -82,7 +82,7 @@ http.createServer((req, res) => {
                         res.end(
                             screen2part1 + obj.humanReadable +
                             screen2part2 + query.state +
-                            screen2part3 + query.scope +
+                            screen2part3 + encodeURIComponent(query.scope) +
                             screen2part4
                         );
                     } catch (e) {
diff --git a/phase-2/poc/client.js b/phase-2/poc/client.js
index 2ff0b29..2c0b0b4 100644
--- a/phase-2/poc/client.js
+++ b/phase-2/poc/client.js
@@ -69,7 +69,7 @@ http.createServer((req, res) => {
                     console.log(`fetched details for scope ${query.scope} from Research Drive`, obj);
                     const webdavUrl = obj.protocols.webdav.url;
                     res.end(
-                        screen3part1 + query.scope +
+                        screen3part1 + encodeURIComponent(query.scope) +
                         screen3part2 + makeid(8) +
                         screen3part3 + webdavUrl
                     );