This question already has an answer here:
To authorize user, our application defined below steps:
- Send user email and password (plain text) through HTTPS.
- When server received it, generate a salt to hash password and store it.
- When user wants to login, verify password with salt.
For revoking an user password easier, I choose to generate a salt on server. But my workmate thinks password should be hashed on client before it sends to server.
My question is if we hash password on client, it will make password more secure. But we still transmit salt to server or we can't verity it. If anyone get this salt, the password is still insecure. How can I protect this request?