in RFC 6749 The OAuth 2.0 Authorization Framework
2.3.1. Client Password
definitely states that authentication at TokenEndpoint
can be done in two alternate ways
- HTTP basic authentication - client_id:client_secret
- in the POST request-body, client_id={client_id}, client_secret={client_secret}
While Facebook API demands a Get request with URL encoded parameters:
GET https://graph.facebook.com/oauth/access_token?
client_id={app-id}
&redirect_uri={redirect-uri}
&client_secret={app-secret}
&code={code-parameter}
Isn't this (non standard compliant way) exposing of client passwords in URL breaking security logic of AUTH2. And opening doors to vulnerabilities?