The specification mentions in https://github.com/acquia/http-hmac-spec#string-to-sign
QueryParameters: Any query parameters or empty string. This should be the exact string sent by the client, including urlencoding."
However, in practice, the library is signing the url-decoded URL instead of the exact string.