I am currently using a technique where I send the username/password in cleartext (using https) to the server, which then does bcrypt and compares to the db. Standard practice.
It is considered safe.
Would sending bcrypt hash to the server for checking be equally safe?
The point of bcrypt is that it is computationally expensive, so that stolen hashes cannot be brute forced (or would take a long time). With the client sending the hash, i think this still holds true.
So, the question is, would this technique compromise my network's security in any way?
I would like to do this because it reduces the computational power the server needs. Doing moderately expensive things on the client is never a bad idea.