bshaffer/oauth2-server-php — pull request #466 by paulstatezny (2014-09-30 19:17:00+00:00)
Title: Make validateAuthorizeRequest not specific to a single HTTP method.

In `AuthorizeController::validateAuthorizeRequest` the parameters (client_id, redirect_uri, response_type, and state) should be allowed to come from either GET or POST params.

Currently they are expected to come from GET params which implies that implementations should use `GET` rather than `POST`. This is not good. If an implementation uses `GET`, usernames and passwords will be sent in the URL, and could be cached in the user's browser history. It's a security concern.

In order to be secure, developers are currently required to create a faux request and inject the `POST` params into the `GET` parameter bag.

The OAuth2 specification doesn't appear to have an opinion about the internal handling of an Authorize Request. Furthermore, the "Authorization Code" implementations on Facebook and Google use `POST`, not a `GET`.

Thanks!