When using authorization header for client_credentials grant type in OAuth2, credentials are also sent in body

[nizmow]

As in the title, the client credentials get sent both in the "Authorization" header, AND in the body of the request. This upsets some authorisation servers (notably for me, servers using the DotNetOpenAuth library). DNOA claims that the OAuth2 spec disallows it, but I can't find the relevant section (perhaps an earlier draft).

[nizmow]

Obviously not much will come of this. :)