I want to be able to login directly from my .net application's login (without having to use the user's security token). And I was wondering if it was possible to send my username and password to the salesforce OAuth endpoints via Ajax and then retreive the access token and other values without getting redirected to the salesforce page. And if it were possible how would I implement it? Since I'm a complete beginner when it comes to this so any help would be appreciated. And I'm not sure about this but wouldn't sending the username and password be a security risk? Or is there a way to protect these informations. And if someone wanted to clarify this a bit it would be great since I'm still looking around these solutions.
Using OAuth, you will need to redirect to Salesforce. Salesforce employs a number of login security features depending on the user's permissions and customization. For example, you can use the Lightning Login app, an SMS single-use code, an email single-use code, etc; if their browser is already authenticated, no code will be required and they may even log in automatically. The security token is only required if you use the SOAP login() call. Your app doesn't need to open a new window; you can just use a WebView (or similar) to perform the login action if you prefer to keep everything in the same window. However, the downside is that the user will likely need to use whatever 2FA is configured (e.g. one-time code).
Have you looked at Understanding the Username-Password OAuth Authentication Flow?
Per the warning on the page:
This OAuth authentication flow passes the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token is issued.
You cannot get a refresh token this way, though, so it can only be used to get a temporarily usable token and you need to submit user/pass each time you want that token (as far as I can tell from the docs).
Why is it that you want to avoid the Salesforce oAuth screen? FWIW the oAuth flow has become a standard for a reason.
Storing passwords in an application is always risky from security perspective .The security token is a security feature which expires everytime password changes .You can learn about some of the security measures salesforce recommends here.
The other option that you could use is an oauth JWT based flow .
With this approach you will create a connected app for your application and register a certificate .You will get clientId and also the certificate private key.
Securely store the private key and the client Id in a secure DB and you can use only the username to generate a JWT based token based on the client Id and the certificate private key .
This way you don't have to ask for the password or even a security based token .