hwi/HWIOAuthBundle — pull request #526 by CEikermann (2014-03-24 17:11:09+00:00)
Title: Security Issue: Send authorization via header instead of parameter

All OAuth2 provider should accept the authorization via header. The header is optional.

"Clients SHOULD make authenticated requests with a bearer token using the Authorization request header field with the Bearer HTTP authorization scheme. Resource servers MUST support this method."
http://self-issued.info/docs/draft-ietf-oauth-v2-bearer.html#authz-header )

It is also a huge security issue to send the access token via parameters, because all logs will store the full url with paramters.