While trying to debug my openid implementation with Google, which kept returning Apache 406 errors, I in the end discovered that my hosting company does not allow to pass a string containing "/id" as a GET parameter (something like "example.php?anyattribute=%2Fid" once URL encoded).

That's rather annoying as Google openid endpoint includes this death word "/id" (<https://google.com/accounts/o8/id>) so my app is returning 406 errors every time I log in with Google because of this. I contacted my hosting company who told me this has been deactivated for security purposes.

I could use POST instead, for sure. But has anyone got an idea why this could cause security problems ???