I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am creating the game using Lua + Love2D, upon launch of the game the user will be presented with a login and password field. The process will go as follows:
- User submits their data
- Client sends their username to the server requesting their password salt
- Client receives salt from server and appends it to their input
- Client hashes appended password a certain amount of times using SHA256
- Client sends final hash to server
- Server checks it's the correct hash
- Client receives 'true' or 'false' depending if it's the correct password
Now my question is, I hear that someone can easily intercept this data, and get their username, salt, and password hash, then basically send this information to the server somehow getting them authentication to that persons accounts. How can I prevent this from happening? Can I use something like an authentication key? If so, can you explain how that would work?