So I am trying out Spring Security using OAuth2 in Spring Boot 2.
I based this site as my reference:
https://dzone.com/articles/secure-spring-rest-with-spring-security-and-oauth2
Once the Authorization server has been set up, tokens can be obtained from it using http://localhost:8080/oauth/token endpoint by passing a POST request.
What makes me squeamish is that the POST request must have my username and password as plain text
POST /oauth/token HTTP/1.1
Host: localhost:8080
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="grant_type"
password
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="username"
admin
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="password"
password
------WebKitFormBoundary7MA4YWxkTrZu0gW--
Isn't this a very big security threat? Wont every router along the way from the client to server be able to see the content of the POST body?
Now to solve this suppose I use a client side symmetric encryption algorithm in javascript to encrypt the password. Since all clients will get the same encryption algorithm, the routers along the way can symmetrically decode my password. Which is not good enough.
If I had to pass the credentails as plain text, then what is the use of Spring Security? Am I doing anything wrong here? There is no way big corporations use this. Is there any additional facility in Spring Security that allows us to prevent this situation?