Handling authentication for a web app

Question

Sending username and password as plaintext, but trough HTTPS; then on server hash(salt+password) and compare that with the hash in the DB. (salt is per-user)

Doin' it right? :)

Cheers

PS: I'm using Ruby/Sinatra, gonna serve via lighttpd, I think.

Answer 1

It really depends on your threat modeling. HTTPS is prone to man-in-the-middle attacks, so if Phishing is expected to be a threat - you better improve your authentication protocol.