The OAuth 2.0 spec states that when authenticating with a client password, you may pass the client_id and client_secret using either:

  • the Authorization header, using the HTTP Basic authentication scheme, OR;
  • the request body.

The spec recommends not using the request body, stating that this method should be limited to only those clients that are unable to use the HTTP Basic authentication scheme.


What is the rationale for this recommendation?


Both methods are acceptable, most likely for compatibility with existing implementations at the time that either used one or the other.

However, only the HTTP Basic authentication was then made mandatory to implement by authorization servers so adding the additional recommendation to not use the optional one was probably intended as a way to get everyone using the same method.

In relation to why the decision pended to HTTP Basic and not the request-body I would say that the fact that the history of OAuth 2.0 includes ties to OAuth WRAP is a decisive factor.

As additional info:

Use of the Authorization header is RECOMMENDED, since HTTP implementations are aware that Authorization headers have special security properties and may require special treatment in caches and logs.

(source: OAuth Web Resource Authorization Profiles (OAuth WRAP))

Authorization headers are recognized and specially treated by HTTP proxies and servers. Thus, the usage of such headers for sending access tokens to resource servers reduces the likelihood of leakage or unintended storage of authenticated requests in general, and especially Authorization headers.

(source: OAuth 2.0 Threat Model and Security Considerations (RFC 6819))

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.