I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client sends a plaintext user/pass in a POST request over HTTPS. Is this secure enough? Considering the server hashes the plaintext pass with the stored salt using something like bcrypt, with enough iterations.
Is this scenario secure enough? Ignoring other attack vectors such as SQL injections, XSS etc. I am simply looking to see if sending plaintext password over SSL in a POST request is secure enough, or if some other security might be necessary, on the client side.