How to securely send/store password in a Spring RESTful login service

Question

In the login service, a user is posting a json as payload to a Spring RESTful login service like below:

{
 "username": "john",
 "password": "doe"
}

Once the Spring RESTful service receives the call, it compares the password with the one store in the database in plain text.

I see two problems in the current implementation.

1. The password is sent through HTTP as a POST payload in plain text.
2. The correct password stored in the database is in plain text.

---

For issue 2, I decided to use bcrypt to encrypt the password stored in the database as mentioned in this post. Is this a good way?

For issue 1, I don't know if there is a best practice for it. Can some one share your insigts? Thanks!

Edit:

Sorry that I forgot to mention that the client and server talks through HTTPS. And the password is sent in POST payload.

In this case, the solution to issue 2 (store bcrypted correct password) in the database is okay, right?

What about in issue 1, in this case, the password can be sent in the post payload in plain text?

Answer 1

1. Use HTTPS.
2. Password should be in request body, so use POST.
3. Don't hash the password before sending.
4. Compare hash stored in the db with hashed received password.

There is no reason to encrypt passwords. It's a bad idea. They should be hashed and preferably salted. In case someone stoles your database, it'll be harder to compromise your users' passwords.

How to securily store passwords.