SSL: Do I need to secure every endpoint
<p>I'm currently building several web apps (built as SPA using Angular) connected to an API. These apps and the API are all using SSL.</p>

<p>Recently, some of our client needed to connect to our API for authentication purpose (using the Resource Owner Password Credentials Grant from OAuth2) but his website <strong>is not</strong> using SSL.</p>

<p>So my question is related to security. If the API is using SSL but the request origin (my client's website) is not, are the data send to the API secure? </p>

<p>Using the Resource Owner Password Credentials Grant from OAuth2, user credentials are actually send as POST toward the API. Those <strong>MUST</strong> be encrypted (man-in-the-middle attack).</p>

<p>From what I understood, it is still secure as the client need to handshake the server using it's cipher. But I would like to be sure so, explanation are more than welcome.</p>