title: How to build a fully secure login: do I need SSL?
body: <h2>context</h2>
  
  <p>I'm building a project to better understand login/security, and SSL is really tripping me up.
  So far I have a front end (vue.js), an API (node/express), and a DB (postgreSQL).</p>
  
  <p>This is the general auth flow:</p>
  
  <ul>
  <li>When a user logs in they send an email and password (via Axios) to the API. </li>
  <li>The API queries the database for a matching username and then using bcrypt.compare it checks the password that is hashed in the database. </li>
  <li>If this is successful, the API signs a JWT and sends it to the client. </li>
  <li>The client then saves the JWT in local storage and is used for future queries.</li>
  </ul>
  
  <h2>question(s)</h2>
  
  <p>So far I think that all of the above is the best practice EXCEPT for the first step. From the reading, I've done so far the client needs SSL to securely send a password to the API. Is this the case? Does my server also need to be SSL or just the client/host?</p>
  
  <p>I'm ultimately going to try to use firebase hosting (which is automatically SSL) for the frontend, and heroku for the API and database. If there are more secure options I'm open to suggestions.</p>
  
  <p>Also, in general, I'm new to all of this security stuff - If I'm missing anything or if something else isn't secure, I would love the advice!</p>