使用HTTPS的情况下，密码可以以明文传输 It‘s ok to send password in plain text over https

It is standard practice to send "plaintext" passwords over HTTPS. The passwords are ultimately not plaintext, since the client-server communication is encrypted as per TLS.

Encrypting the password before sending it in HTTPS doesn't accomplish much: if the attacker got their hands on the encrypted password they could simply use it as if it were the actual password, the server wouldn't know the difference. The only advantage it would provide is protecting users that use the same password for multiple sites, but it wouldn't make your site any safer.

原讨论：

https://security.stackexchange.com/questions/110415/is-it-ok-to-send-plain-text-password-over-https