Pass username and password to Flask Oauth2 Server (password grant type)
<p>I'm implementing Flask REST API with Flask-Oauthlib and wondering is it ok to pass username and password in URL parameters? For example:</p>

<pre><code>GET http://127.0.0.1:5000/api/token?client_id=CLIENT_ID&amp;grant_type=password&amp;username=myusername&amp;password=hopeudontseemypass
</code></pre>

<p>In my development environment all the requests are showing in logs as plain text like this:</p>

<pre><code>127.0.0.1 - "GET /api/token?client_id=CLIENT_ID&amp;grant_type=password&amp;username=myusername&amp;password=hopeudontseemypass HTTP/1.1" 200 -
</code></pre>

<p>Is there any way to pass base64 encoded username/pass in request headers? All the password grant type examples are using username and password in URL parameters, so don't know is this a really problem if server will use SSL.</p>

<p>The OAuth protocol spec says that the parameters must be POST-ed to the token endpoint. By accepting them as query parameters the Authorization Server violates the spec. Better use POST to avoid the credentials ending up in log files.</p>

python authentication flask oauth-2.0 flask-oauthlib