diff --git a/server/www/teleport/static/js/auth/login.js b/server/www/teleport/static/js/auth/login.js
index 79eb638..bc4f9fc 100644
--- a/server/www/teleport/static/js/auth/login.js
+++ b/server/www/teleport/static/js/auth/login.js
@@ -242,7 +242,7 @@ $app.do_account_login = function (username, password, captcha, oath, is_remember
 
                 if (ret.code === TPE_EXPIRED) {
                     // must change password before login.
-                    window.location.href = '/user/change-expired-password?username=' + username;
+                    window.location.href = '/user/change-expired-password?username=' + encodeURIComponent(username);
                 }
 
                 $app.show_op_box('error', '登录失败：' + tp_error_msg(ret.code, ret.message));
diff --git a/server/www/teleport/webroot/app/controller/user.py b/server/www/teleport/webroot/app/controller/user.py
index d232529..8f22c34 100755
--- a/server/www/teleport/webroot/app/controller/user.py
+++ b/server/www/teleport/webroot/app/controller/user.py
@@ -4,6 +4,7 @@ import csv
 import json
 import os
 import time
+import urllib
 
 import tornado.gen
 from app.base import mail
@@ -116,7 +117,7 @@ class ResetPasswordHandler(TPBaseHandler):
 
 class ChangeExpiredPasswordHandler(TPBaseHandler):
     def get(self):
-        _username = self.get_argument('username', None)
+        _username = urllib.unquote(self.get_argument('username', None))
         if _username is None:
             return self.redirect('/')