Безопасно ли хранить пароль и логин в js?

я и так храню токен на клиенте и с каждым запросом отправляю в хедере. Мой метод контроллера авторизации:

[HttpPost]
        [Transactional]
        public async Task<IActionResult> Post([FromBody] AuthenticationRequest request,
            [FromServices] IAuthenticationManager authentication)
        {
            var jwt = await authentication.AuthenticateWithRefreshAsync(request.Login, request.Password, request.OrganizationBin);
            if (jwt == null)
            {
                return Ok(ApiResponse.Failed(ApiErrorCode.AuthenticationFailed, "Неверный логин\\пароль"));
            }
            return Ok(ApiResponse.Success(jwt));
        }

Модель :

public class AuthenticationRequest {
        [Required]
        public string Login { get; set; }
        [Required]
        public string Password { get; set; }
        [Required]
        public string OrganizationBin { get; set; }
    }    

Вот код который в хедер вписывает токен:

import { Injectable } from '@angular/core';
import {
  HttpRequest,
  HttpHandler,
  HttpEvent,
  HttpInterceptor,
  HttpErrorResponse
} from '@angular/common/http';
import { AuthService } from '../services/auth.service';
import { Observable, of, throwError } from 'rxjs';
import { Router } from '@angular/router';
import { catchError } from 'rxjs/operators';
@Injectable()
export class TokenInterceptor implements HttpInterceptor {
  constructor(
    public auth: AuthService,
    private router: Router
  ) { }
  intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
    if (this.auth.isLoggedIn()) {
      request = request.clone({
        setHeaders: {
          Authorization: `Bearer ${this.auth.getToken()}`
        }
      });
    }
    return next.handle(request);
  }  
}