{"action":"created","issue":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/340","labels_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/340/labels{/name}","comments_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/340/comments","events_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/340/events","html_url":"https://github.com/thephpleague/oauth2-server/issues/340","id":73634293,"number":340,"title":"ResourceServer: access_token in requests other than GET","user":{"login":"demagu","id":150876,"avatar_url":"https://avatars.githubusercontent.com/u/150876?v=3","gravatar_id":"","url":"https://api.github.com/users/demagu","html_url":"https://github.com/demagu","followers_url":"https://api.github.com/users/demagu/followers","following_url":"https://api.github.com/users/demagu/following{/other_user}","gists_url":"https://api.github.com/users/demagu/gists{/gist_id}","starred_url":"https://api.github.com/users/demagu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/demagu/subscriptions","organizations_url":"https://api.github.com/users/demagu/orgs","repos_url":"https://api.github.com/users/demagu/repos","events_url":"https://api.github.com/users/demagu/events{/privacy}","received_events_url":"https://api.github.com/users/demagu/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-06T14:13:25Z","updated_at":"2015-09-04T10:17:26Z","closed_at":"2015-06-01T12:45:53Z","body":"Hello,\r\n\r\nWhat is the reasoning behind this code:\r\n```php\r\n$accessToken = ($this->getRequest()->server->get('REQUEST_METHOD') === 'GET')\r\n                                ? $this->getRequest()->query->get($this->tokenKey)\r\n                                : $this->getRequest()->request->get($this->tokenKey);\r\n```\r\nhttps://github.com/thephpleague/oauth2-server/blob/master/src/ResourceServer.php#L143\r\n\r\nIn case I wanted `access_token` to be passed as query string parameter in all request methods (POST, PATCH, DELETE etc) the above line will prevent it. \r\n\r\nWhat would be the best way of making this possible? \r\n\r\n"},"comment":{"url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/comments/137696626","html_url":"https://github.com/thephpleague/oauth2-server/issues/340#issuecomment-137696626","issue_url":"https://api.github.com/repos/thephpleague/oauth2-server/issues/340","id":137696626,"user":{"login":"andreikun","id":11534054,"avatar_url":"https://avatars.githubusercontent.com/u/11534054?v=3","gravatar_id":"","url":"https://api.github.com/users/andreikun","html_url":"https://github.com/andreikun","followers_url":"https://api.github.com/users/andreikun/followers","following_url":"https://api.github.com/users/andreikun/following{/other_user}","gists_url":"https://api.github.com/users/andreikun/gists{/gist_id}","starred_url":"https://api.github.com/users/andreikun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andreikun/subscriptions","organizations_url":"https://api.github.com/users/andreikun/orgs","repos_url":"https://api.github.com/users/andreikun/repos","events_url":"https://api.github.com/users/andreikun/events{/privacy}","received_events_url":"https://api.github.com/users/andreikun/received_events","type":"User","site_admin":false},"created_at":"2015-09-04T10:17:26Z","updated_at":"2015-09-04T10:17:26Z","body":"If you want to access secured paths using access_tokens as query string informations below might help you:\r\n\r\nCheck here: https://github.com/thephpleague/oauth2-server/blob/master/src/ResourceServer.php#L146\r\n\r\nIt shouldn't be $this->getRequest()->request->get($this->tokenKey). Instead it should be $this->getRequest()->get($this->tokenKey).\r\n\r\nThat;s why it does not work. I already adjusted my code, it would be nice if someone from phpleague will adjust too.\r\n\r\nIt works now with both POST and GET having access_token in query string like ?access_token= mQ77AR4vzpTdn81Sc4os7FdRYWd3UJJjQ1GBJ3Us"}}