Credentials in request-body as fallback per 2.3.1 of RFC about fosite

[aeneasr]

I think that it is easier to filter out the Authorization http header in logs instead of filtering specific values in bodies like client_id or client_secret. Otherwise I do not know why this method is not recommended.

I realize that some libraries implement faulty behaviour which is why I wrote this library here. I'd rather not include a fallback as I'm trying to follow all the good practices the IETF recommends.

Let me know if you disagree, I'm open for discussion! :)

[cristiangraz]

I was actually thinking the same thing -- and not really sure why a client wouldn't be able to send an Authorization header. More of an inconvenience with the rest client I'm using, but I agree this library is stricter than most (which is what I like about it!) and should avoid everything but best practices. Thanks for chiming in so quickly!

[aeneasr]

Sure, thanks for your thoughts, feedback and contributions! I appreciate it!