In section 2.3.1 of the the OAuth 2.0 Authorization Framework it states:
The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a client password.
It goes on further to say:
Including the client credentials in the request-body using the two parameters is NOT RECOMMENDED and SHOULD be limited...
Why is it that
including the client credentials in the request-body using the two parameters is not recommended?
I can think of any reason. If it is good enough for user credential to be in plain text in the request body, why isn't it good enough for client credentials? The client credentials are still in plain text despite the encoding required by the basic authorization. Am I missing something?