Oauth 2.0 password grant type is penetrated

[#1]

We are facing an issue with OAuth 2.0 password grant type. We are using one way TLS for communication. The user name and password are sent in the body of urlencoded type. Still, our penetration team is able to get the credentials. what should be the best practice to avoid this?

[dchiesa1]

our penetration team is able to get the credentials.

You'll have to be more specific about the problem.

[#3]

the team is able to get the username and password we are sending in the body as urlencoded one.

[dchiesa1]

I understand. Exactly how is the team obtaining the password. Can you explain in more detail?

[pradeepshanmugh]

Please note / consider the below best practice guidance
https://tools.ietf.org/html/draft-ietf-oauth-security-topics-13#section-3.4

The OAuth2 working group recommends strongly against the use of this flow entirely

[#6]

Yes, the link clearly states not to use. Thanks..

Hope this will support us to change our API security standards.