From 5dab4167f31cbd76b407f1486c86b40748bc5073 Mon Sep 17 00:00:00 2001 From: Peter Dotchev Date: Tue, 15 Jan 2019 08:29:34 +0000 Subject: [PATCH] Clarify that client credentials are not passed in the URL The term "query parameters" suggested that the credentials are passed in the URL which is insecure and is actually not true as the credentials are passed in the request body. See https://github.com/golang/oauth2/blob/36a7019397c4c86cf59eeab3bc0d188bac444277/internal/token.go#L196 Change-Id: Id0a83f8d317fed30e18310b30860000109dafe88 GitHub-Last-Rev: 3961bc9affcbdb16a6e0b4db58ce0526da8e728b GitHub-Pull-Request: golang/oauth2#358 Reviewed-on: https://go-review.googlesource.com/c/157877 Reviewed-by: Brad Fitzpatrick --- oauth2.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/oauth2.go b/oauth2.go index 1e8e1b7..3de6331 100644 --- a/oauth2.go +++ b/oauth2.go @@ -31,7 +31,7 @@ var NoContext = context.TODO() // which doesn't support the HTTP Basic authentication // scheme to authenticate with the authorization server. // Once a server is registered, credentials (client_id and client_secret) -// will be passed as query parameters rather than being present +// will be passed as parameters in the request body rather than being present // in the Authorization header. // See https://code.google.com/p/goauth2/issues/detail?id=31 for background. func RegisterBrokenAuthHeaderProvider(tokenURL string) {