Oauth2 plain text credentials in POST request? - spring-boot

Question

So I am trying out Spring Security using OAuth2 in Spring Boot 2.
I based this site as my reference:
https://dzone.com/articles/secure-spring-rest-with-spring-security-and-oauth2
Once the Authorization server has been set up, tokens can be obtained from it using http://localhost:8080/oauth/token endpoint by passing a POST request.
What makes me squeamish is that the POST request must have my username and password as plain text
POST /oauth/token HTTP/1.1
Host: localhost:8080
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="grant_type"
password
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="username"
admin
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="password"
password
------WebKitFormBoundary7MA4YWxkTrZu0gW--
Isn't this a very big security threat?
Wont every router along the way from the client to server be able to see the content of the POST body?
Now to solve this suppose I use a client side symmetric encryption algorithm in javascript to encrypt the password. Since all clients will get the same encryption algorithm, the routers along the way can symmetrically decode my password. Which is not good enough.
If I had to pass the credentails as plain text, then what is the use of Spring Security?
Am I doing anything wrong here? There is no way big corporations use this.
Is there any additional facility in Spring Security that allows us to prevent this situation?

Answer 1

You have to use HTTPS (TLS), see The OAuth 2.0 Authorization Framework
Token Endpoint
[...]
Since requests to the token endpoint result in the transmission of
clear-text credentials (in the HTTP request and response), the
authorization server MUST require the use of TLS as described in
Section 1.6 when sending requests to the token endpoint.
If your authorization server implementation allows unsecured communication, it is not compliant to OAuth2 spec.