I am in a bit of confusion as we have been asked to AES encrypt passwords before sending it to the server. The whole website communicates over HTTPS with the server and uses secure cookies.
AFAIK, HTTPS uses an SSL 128 bit encryption (could be 256 bit, not sure) and this happens at the Transportation Layer. I am assuming as long as the client is not compromised, an attack at Presentation or Application layer is not possible. Thus, once SSL encrypted, I think information will reach the server safely.
So is it still required to encrypt valuable information such as passwords at the client side before sending it to the server?