I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with a token that will be saved in the frontend so it knows who's logged in. The thing that confuses me here, is that the passwords should definitely be hashed in the react application so there's never any plain-text passwords sent over the network. But that also means that comparing the password to the saved hash happens on the frontend, at least when I want to use bcrypt:
hashedPassword = bcrypt.hashSync(passwordFromSignupForm, bcrypt.genSaltSync());
doesPasswordMatch = bcrypt.compareSync(passwordFromLoginForm, existingUser.hashedPassword);
This generates a different hash for the same input. And I suppose that's how it's supposed to be done, because people do recommend this way of working. But how would I let the flask application know that the login was succesful? I mean... I can't just send an "okay" to the backend and expect a token back, right? I feel like that can be highjacked really easily. This makes me think that the check if the inserted password was correct, should be done by the python backend and not by the react frontend... But then again, never send plain text passwords over the internet.
So how can this be solved? Thanks in advance!