User credentials in OCC URL

[former_member619821]

Hello Experts,

We are building OCC APIs for mobile application and the first concern raised by security team is they can't send credentials in API URL.

But OOB OCC authentication url looks like https://localhost:9012/authorizationserver/oauth/token?client_id=mobile&client_secret=secret&grant_t...

Is there any way we can avoid passing sensitive data like email & password in URL.

Thanks in advance.

Cheers
Anil

[former_member637469]

Hi Anil,

Please have a look at the following link.oAuth2.0 this should help you get some thoughts on how you can leverage different flows for password flows to achieve what you want to achieve. Resource Owner Password Flow to be precise should work for you. Share your thoughts.

thanks,

[VinayKumarS]

Hi Anil,

If you are using this url directly in browser then you have to pass them as parameters. But if you pass them in header. You dont need to append these id password to url. You can try this check from postman.

[former_member619821]

Hi Vinay,

Thanks for the reply, but I'm unable to test this. Could you provide an example header in Postman!

Thanks

[VinayKumarS]

[former_member619821]

Thanks Vinay,

I was able to achieve this by sending x-www-form-urlencoded values