Intro
A common technique to securely hash passwords is to use salting and peppering. Salt comes from the database and pepper comes from the server. This means that both salting and peppering are server-side operations.
Situation
When hashing a password, I would prefer to hash after applying salt and pepper, because applying salt and pepper onto an already existing hash using simple concatentation or similar string injection would make patterns appear that make it realatively easy for hackers to extract salt and pepper from the hash.
Problem
But the problem with hashing after salt and pepper, is that this means that the hashing needs to happen on the server-side. This subsequently means that you'd still have the plain-text password on the server because it isn't hashed yet, which measn that a plaintext password has travelled through an http(s) request.
This makes it seem rather sketchy. If hackers would be able to decrypt an https request, I would much rather expose a hash then a plaintext. But sending the hash from the client-side is not possible since client doesnt have the salt and pepper.
My solution (which is what I want to verify)
My idea as a solution would be to hash the password on the client without salt and pepper. Then send this to the server and then the server concatentates this hash with salt and pepper before hashing the entire thing again.
Is this 'double hash' actually a thing? How is this done otherwise?
