Describe OAuth's use of application/x-www-form-urlencoded encoding · Issue #128 · oauth-wg/oauth-v2-1 (original) (raw)

499a8f8 removed Appendix B but unlinked references to it are still within the document next to almost every x-www-form-urlencoded mention.

Throughout the years this Appendix was THE resource used over and over to explain why and how the OAuth use of the Basic authorization scheme encodes the username and password tokens.

If this Appendix is removed I would propose to add examples of client secret basic with username and password tokens where the client_id and client_secret encoding changes the octets that go into the basic authorization scheme base64 encoding. This is an often overlooked implementation detail that both client and server implementers get wrong and end up inoperable, further driving users to use client secret post which this document marks as NOT RECOMMENDED.