This question already has an answer here:
Im doing a little research in my question but no found any concrete answer. I have a client-server architecture. Im using Bcrypt as hash function (the password its store as double hash), and HTTPS to protect the channel.
Lets suppose my client is performing login. Im using nounces for One-Time-Password login.
Should i do the Hash(password) at client side and send it to server to validate? Or just send the clean text password through the HTTPS and do at server side Hash(password) and validate it?