title: Should clients get OAuth 2 access tokens using GET or POST?
body: <p>The OAuth 2.0 draft v2-22 Section 3.2 says:</p>
  
  <blockquote>
    <p>The client MUST use the HTTP "POST" method when making access token
    requests.</p>
  </blockquote>
  
  <p>However, if you look at the <a href="https://developers.facebook.com/docs/authentication/" rel="noreferrer">Facebook</a> and <a href="https://developer.foursquare.com/docs/oauth.html" rel="noreferrer">Foursquare</a> OAuth2 implementations, they ask the clients to make a simple GET request for requesting an access token. They ask the clients to place the client_id and client_secret in the URL.</p>
  
  <p>I am building an OAuth 2 server and after seeing Facebook's and Foursquare's implementations, I am strongly considering also breaking the protocol to allow clients to request the access token via GET. My site's communication is using SSL, similar to Facebook and Foursquare.</p>
  
  <p>So my question is this: Are there any good reasons why I shouldn't allow clients to request access tokens via the GET method over HTTPS?</p>