title: client_id and client_secret sent via param vs in url
body: <p>I'm having some problems with my Oauth2 server (Spring) when trying to access some protected endpoints.</p>
  
  <p>If I want to get a token (via Zuul gateway), I'd do something like this:</p>
  
  <pre><code>http://localhost:4444/auth/oauth/token?client_id=gateway&amp;client_secret=1234&amp;grant_type=password&amp;username=user&amp;password=password
  </code></pre>
  
  <p>(Asume above client and user exist correctly and the Content-Type being application/x-www-form-urlencoded).</p>
  
  <p>This call doesn't work, but, if I do it like this:</p>
  
  <pre><code>gateway:1234@localhost:4444/auth/oauth/token?grant_type=password&amp;username=user&amp;password=password
  </code></pre>
  
  <p>Then, it works.</p>
  
  <p>Is this considered normal behavior? As far as I could read, this should work. It's like the id and the secret are not being handled when I sent those as params but when I modify the url, the it's taken and everything works. Do I need implement something extra?</p>
  
  <p>To clarify, the Oauth2 server works when I send the client_id and the client_secret like in the second url but if I send those as params (first url), it doesn't.</p>
  
  <p>You can check the code here (OAuth2-service): <a href="https://github.com/otamega93/CloudBasedUserRegistration2/tree/master/OAuth2-service" rel="nofollow noreferrer">https://github.com/otamega93/CloudBasedUserRegistration2/tree/master/OAuth2-service</a></p>
  
  <p>The configuration is mostly at OAuth2Configuration, WebSecurityConfig and AuthServerApplication. I'm testing with Postman. This also happens when I access directly the Oauth2 server.</p>