OAuth2 password flow sends token request incorrectly

Seems that at least when using Resource owner password credentials flow for authentication, token request is sent incorrectly. Currently code on master sends is like this (/src/core/plugins/auth/actions.js)

let req = {
    url: schema.get("tokenUrl"),
    method: "post",
    headers: {
      "content-type": "application/x-www-form-urlencoded"
    },
    query: {
      grant_type: "password",
      username,
      password,
      scopes: encodeURIComponent(auth.scopes.join(scopeSeparator))
    }
  }

This means that all parameters are sent as query parameters not as part of body as spec defines (https://tools.ietf.org/html/rfc6749#section-4.3.2).

it could use instead body: new FormData(...) of query: {...}

[lakmali]

I am also facing this problem. There is a configuration for sending client credentials; whether to send it as Basic header or in body. But there is no configuration available for sending payload data. Nevertheless, according to the spec, payload should be sent as URL encoded POST payload. So I think, this needs to be fixed.

[bodnia]

@jniemin thanks for your cooperation