HTTP的系统登录页面，如何避免明文传输用户密码？

function login() {
    var username = $.common.trim($("input[name='username']").val());
    var password = $.common.trim($("input[name='password']").val());
    var validateCode = $("input[name='validateCode']").val();
    var rememberMe = $("input[name='rememberme']").is(':checked');
    var key = Math.floor(jQuery.now() / 30000).toString();
    $.ajax({
        type: "post",
        url: ctx + "login",
        data: {
            "username": username,
            "password": encryptByDES(password, key),
            "validateCode" : validateCode,
            "rememberMe": rememberMe
        },
        success: function(r) {
            if (r.code == 0) {
                location.href = ctx + 'index';
            } else {
                ...
            }
        }
    });
}

function encryptByDES(message,key) {
    var keyHex = CryptoJS.enc.Utf8.parse(key);
    console.log("keyHex:"+keyHex)
    var encrypted = CryptoJS.DES.encrypt(message, keyHex, {
        mode: CryptoJS.mode.ECB,
        padding: CryptoJS.pad.Pkcs7
    });
    return encrypted.toString();
}

    // *password 是前端传过来的密文
    long floor = (long) Math.floor(System.currentTimeMillis() / 30000);
    String passwordText = null; // *明文
    try {
        passwordText = DESUtils.decrypt(password, String.valueOf(floor));
    } catch (Exception e) {
        log.error("密码解密异常1:", e);
        try {
            passwordText = DESUtils.decrypt(password, String.valueOf(floor-1));
        } catch (Exception ex) {
            log.error("密码解密异常2:", e);
            return error("非法请求");
        }
    }