protection of parameters in jquey request. Authentication

I am confused by the fact that if you do authentication on the site using a jquery request, then we must allow to write a service or php allow a script (it doesn't matter what) to which to access and transfer the login and password in the JS script. That is, there is a JS script which contains the code for sending a jquery request - it can be inspected in the browser. It is also easy to use my service on another hosting (it is treated by checking where the Request came from). You can also collect packets with a sniffer and easily analyze traffic that is in the simplest json format. Of course, the user is authenticating himself on his computer and he doesn’t make sense to analyze scripts and break something, but I have a strong feeling that there are exceptions in the above written text. At the same time, in theory, I need to get back either an identifier or some GUID from the server so that I can use it in other requests and this is all in the browser (but I may be absent from the computer, but the attacker does not sleep), this is solved by changing the GUID with some time interval. I actually write on ASP and Mikrosovt itself takes care of secure data transmission mainly due to the fact that all operations are performed on the server and everything is encrypted. But there was a task to use asynchronous requests Jquery. Share your experience. How to save data from the attacker. A simple example: authenticated, remembered the identifier, using the identifier we order goods, but if you remove the identifier, you can order goods on behalf of the victim.