title: how secure credentials in an ajax request to get a token (oauth)
body: <p>I'm building a SPA application that uses my API through the OAuth Authentication mechanism. My application doesn't has a login view, so I get a token by writing the username and password in the code same, in this way:</p>
  
  <pre><code>$.ajax({
    type: "POST",
    url:  restServer + "/token",
    dataType: 'json',
    // insecure :
    data: {
       grant_type   : 'password',
       scope        : '*',
       username     : 'someuser',
       password     : 'p4sSw0rd'         
    }
  })
  //...
  </code></pre>
  
  <p>but obviously it is an insecure way to do this, everyone can read the username and the password.
  I tried to find about this problem on stackoverflow, etc. but I don't understand how I can solve it.</p>
  
  <p>someone says to get the user and password from the server, but it has the same security problem.
  someone mentions https, but in this first step it is not involved.</p>
  
  <p>someone has ideas?</p>