spring - Spring Security OAuth 2 Password Grant Disable Query Parameters

Question

I'm using spring-security-oauth2 authorization server. I'm using the password grant for oauth authentication. Currently, this lets users send username and password as query parameters. This is not safe since the password is not protected by HTTP. To handle this, my frontend sends the important information as part of the request body through HTTPS.

We use springfox-swagger2 to generate API specifications. Since query parameters are permitted, the specification generates these fields as required, as you can see in this

The specification also takes in an optional body: I'm wondering what workaround there might be to solve this issue because we are automatically generating typescript models based off the swagger specification and every time we make any changes on our specification, any manual frontend changes of the types will be replaced.

标签： springspring-bootspring-securityspring-security-oauth2

Answer 1

查询字符串使用 HTTPS 加密，但还有其他原因不使用敏感数据的查询参数，例如可以记录查询字符串的服务器日志，https://stackoverflow.com/a/323286/1536382中的更多详细信息

剩下的我不明白是什么问题，这是什么意思

由于允许查询参数

哪里允许？什么说明了这个方面？