I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read plenty about hashing algorithms, salt, and so on. I'm going to use Argon2 since it seems to be the current recommendation. My question concerns how the hashes are stored and checked in terms of overall architecture.
Since hashing with Argon2 is intentionally quite expensive, I want to create a service in a separate module/process so that it can easily be moved to a one or more separate machines if needed. Even if it lived on the same machine as the main app server, it would be trivial to monitor its CPU and memory usage to tune the cost factors for the hashing algorithm.
My app will send HTTPS POST requests to the service to either create, update, delete, or verify a password. All the details will be in the request body, including the password in plain text. The connection will be encrypted. The response will simply be an indication of success or failure.
The service will handle the logic of database operations, hashing passwords, and comparing hashes for equality. The passwords will live in a separate database from the users, so that even if an attacker dumps the entire password database they still don't actually know anyone's password, and vice versa. Also, if I ever migrate to a different storage solution for my other data, there is less migration to do since the passwords can remain as they are.
Does that sound good? Or does it somehow open up more weaknesses that I'm not aware of?