I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
The reason against hashing client-side is just ease of use. If I hash client-side I need to use two separate libraries for hashing. This is not an unsurmountable problem, but it is a nuisance.
Is there a safety gain in using client-side hashing? Why?
Should I also be using challenge-response then?
UPDATE: what interests me the most is this - do these techniques (client-side hashing, request-response) add any significant security gain in case where https is used? If so, why?