In the design of a backend database, the password field suppose to be hashed using bcrypt.
There are two approaches
- backend only: password = bcrypt(plain_passsword)
The advantage of second approach is, there is no plain password being sent over the wire, so even the HTTPS is broken, there is no immediately security risk for our users who leaked their plain password.
Edit: My question is different from existing questions as they emphasise on frontend vs backend, but my question is backend vs frontend+backend