Twitch should use POST when redirecting back from login

[BarryCarlyon]

@MeChiller

As you guys know, After a successful login, Twitch will redirect the user with the code inside query parameters, and if anything goes wrong (for example the receiver’s server is down) the url will be shown to the user ( and its viewers ), my question is, Why Twitch does not put this sensitive data inside the body of the redirect? (like how payment merchants work)

The ?code is useless without the client secret.

The ?code is also one use, so “normal” oAuth flows will use it immeditely.
And thus the ?code will immeditely no longer be valid.