While checking the facebook php sdk implementation I noticed that they expose the access token to the resource owner (user)
$params = array( 'next' => $next, 'access_token' => $session->getToken() ); return 'https://www.facebook.com/logout.php?' . http_build_query($params, null, '&');
How harmful is it considered to be? I cannot explain it, but it just does not look right.
In case it's not "the best practice" how would one implement a logout using oauth v2 flow instead?
I have made some research in the specification and that's what I've found:
Don't pass bearer tokens in page URLs: Bearer tokens SHOULD NOT be passed in page URLs (for example, as query string parameters).