I have an idea to implement a account system using email and passwords for games. Im intending to have the account creation and forget password systems on a webpage. So if users will have to access the webpage in order to access those features. The users will login with those details in the game.
For the account creation and forget password, I'm thinking of setting in my webpage server. While the account database will be stored with the game server which will also host the account's scripts.
Im think that if i were to put my game server script path in the HTML form, the user will be able to know the location of my game server. Thus, for user who wish to hack my server will know the location. With that i was thinking, if the form points to a script in my web server, and that script will sent the data to my game server script. Does that mean the game server will only be comprise if my web server is hacked?
Regarding to the user's email and password, I know that storing the password in plain text is not a good way. The recommended way was to encrypt it with a hash and salt. Im wondering if the encryption and salting should take place at the client side (HTML) or the server side(script at game server)?
If it happens at the game server, i will have to send the password in plain text, ain't it? OR i could hash the password with MD5 or SHA-1 or SHA-256(etc..) at the client side and receive the hashed password at the server side and perform a second round of hashing with salting on the game server?
The things i'm looking for in this question is about how secure for both my users and my server for this method of authentication.