title: What is the best practice for sending password from frontend to API server?
body: <p>I am implementing a web application composed by a Javascript front end (single page application if you prefer), and a Rails backend.</p>
  
  <p>The front end app make request through API to the server, I want to know what is the best practice for sending the password on the login or the password reset.</p>
  
  <p>Should I send the clear password, or should I send the hash?</p>
  
  <p>I think that both of two solutions have their drawbacks:</p>
  
  <p>if I hash the password with JS, the user will have the code in his browser and can understand how I secure the password.</p>
  
  <p>If I keep it clear, beh, it is just clear and so it can be intercepted.</p>