3. 前端不加密，后端加密

frontend:
POST https://domain/login --data "username=admin" --data "password=12345"

backend:
sql = select * from `user` where `username` = :username
result = db.get(sql, {:username => POST.username})

if (result) {
if ( password_verify(POST.password, result.password_bcrypt_hashed) ) {
// login success
} else {
// login fail
}
} else {
// user not found
}