Skip to content
Data protection › Hardening settings › Platform Security
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Restrict oauth parameters to POST body [New in Security Center 1.3]

Use the glide.oauth.allow.parameters.in.post.body.only property to control the inbound OAuth authentication's acceptance of access tokens. Access tokens are sensitive and should only be accepted when located within a POST request body.

More information

AttributeDescription
Configuration nameglide.oauth.allow.parameters.in.post.body.only
Configuration typeSystem Properties \(/sys\_properties\_list.do\)
Data typeBoolean
Recommended valuetrue
Default valuetrue
CategoryData protection
Security risk
  • Severity score: 4.2
  • CVSS score: Medium
  • Security risk details: If glide.oauth.allow.parameters.in.post.body.only isn't set to the recommended value of true, access tokens could be present in the GET request parameter. These access tokens could linger in client and infrastructure logs and potentially lead to account takeover if those logs are leaked.
Dependencies and prerequisitesNone
References- OAuth 2.0 - Manage OAuth tokens
Functional impactEnsures that oauth\_token.do processor accepts only POST body parameters as input for all supported grant types.

Parent Topic:Data protection