The current implementation has the user add the credentials in a plain text header that anyone with access to can read and use. This is even promoted 

Automation for Jira - Send web request using Jira ... - Atlassian Community

For basic auth the password should be obfuscated 

And there should be additional options for other types of Auth