1

You are correct, that sending any credentials as GET parameter isn't best practice. OWASP ASVS (currently version 4.0.1) states this explicitly in requirement 3.1.1: Verify the application never reveals session tokens in URL parameters or error messages. In addition, RFC6749 gives an actual example for the client credentials grant, where the token is sent ...


Only top voted, non community-wiki answers of a minimum length are eligible