Authentication system using AJAX

Question

I'm building an authentication system using a combination of PHP, MySQL, jQuery, and AJAX. The way I'm doing it right now is I have a form that takes in a username and password. When the user clicks on the login button I pass the value of those two values along with an action to a controller file. That controller file will use an Authentication object (I wrote my own Authentication class) to determine if the user is authenticated or not. If so, it will return a string that says "authenticated" or something similar. I check for that value in the response of the AJAX request and go from there based on the response. Of course I do all sorts of server side checks so someone can't just navigate to a certain section or tamper with my jQuery to trick the system. It's all enforced behind the scenes.

Is this acceptable? Is there any major problem with doing this the way I am? Here are some snippets of my code that is responsible for handling all this:

Login section:

<div data-role="content">
    <div class="center" id="loginContainer" data-role="fieldcontain">
        <input id="username" type="text" placeholder="Username" />
        <input id="password" type="password" placeholder="Password" />
        <br />
        <a id="loginButton" href="#" data-role="button" data-inline="true">Login</a>
    </div>
</div>

jQuery:

$(document).on("click", "#loginButton", function() {
var user = $("#username").val();
var pass = $("#password").val();

    $.post("controllers/auth.php", {"action": "authenticate", "user": user, "pass": pass}, function(data) {
        if(data == "authenticated") {
            //stuff
        }
    });
});

Controller:

if(isset($_POST['action']) && $_POST['action'] == "authenticate") {
    $credentials = array("user" => $_POST['user'], "pass" => $_POST['pass']);
    $auth = new Auth($dbh, $ldaps, $credentials);
    if($auth->authenticate()) {
        echo "authenticated";
    }
}

Answer 1

Do all URLs on your site use SSL? If not you'll need to setup your site to at least support the authenticate URL over HTTPS.
Currently your passing a plain text Username and Password - anyone can grab them.

On requests after the login, how are you determining whether or not the user is authenticated? It does not look like you are persisting the login in any way, unless Auth class is doing it behind the scenes. Typically this is done with a session variable or cookie.