CODEWITHSUNDEEP
spring-securitypasswordsspring-security-oauth2
user3565529
user3565529

Reputation: 1367

password in URL in spring security oauth2 token endpoint

I am using spring security oauth2 password grant for authenticating users with clientid/client secrets. The issue that I am facing is that the endpoint takes the password as a query parameter. This gets logged in the access logs for the server on which this service will be running. I have a wrapper over the endpoint which is internally calling the token endpoint using HTTP.

I have no control on the server and will not be able to mask password or disable access logs.

Is there any way of directly invoking the underlying endpoint controller method itself without using the REST endpoint for doing this or some other way in which the password does not need to be sent by the query parameters?

Upvotes: 1

Views: 892

Answers (1)

mgalala
mgalala

Reputation: 106

token endpoint accepts to get the parameters with POST method and you can then supply the content-type header as application/x-www-form-urlencoded and the parameters as x-www-form-urlencoded params

Upvotes: 1

Related Questions