api-tester | Api Tester is a tool which allows you to perform tests | Mock library

I would like to restrict my Laravel API from processing parameters as query-string when trying to authenticate the user. I've been trying with POSTMAN and all the time I'm able to get the token from my API whether I put the credentials on the body or as query-string in the url.

As per Laravel documentation I think that this is the behavior I want to avoid:

Retrieving Input Via Dynamic Properties

You may also access user input using dynamic properties on the Illuminate\Http\Request instance. For example, if one of your application's forms contains a name field, you may access the value of the field like so:

$name = $request->name;

When using dynamic properties, Laravel will first look for the parameter's value in the request payload. If it is not present, Laravel will search for the field in the route parameters.

I'm using Laravel 5.3 and PHP 7.1.0

Here is the POST by using query-string:

Here is the POST by using parameters in the body:

I have configured my CORS by using laravel-cors: