diff --git a/src/http.c b/src/http.c
index ee0dc774..c383f53e 100644
--- a/src/http.c
+++ b/src/http.c
@@ -117,9 +117,9 @@ char *oidc_http_url_decode(const request_rec *r, const char *str) {
 		goto end;
 	}
 
-	replaced = (char *)str;
-	while (str[counter] != '\0') {
-		if (str[counter] == '+') {
+	replaced = apr_pstrdup(r->pool, str);
+	while (replaced[counter] != '\0') {
+		if (replaced[counter] == '+') {
 			replaced[counter] = ' ';
 		}
 		counter++;