I've recently been following the FastAPI Documentation on Security - OAuth2, Password Hashing, Bearer, and JWT. In attempt to setup my own Login/Token system. For the most part I understand the inner workings of what is going on under the hood.
My concern is when it comes to overall security and protection of peoples privacy. Most tutorials even FastAPI explains how to hash and store a password to your database. So I plan to Hash my users passwords when they are sent from the Front End in regards to User Creation and Forgot Password/Change Password.
Verifying in that sense it simple. The password is sent from the front end (In my case React) via form data. I use Bcrypt to "un-hash" / "compare" it and if it matches then the API will perform the process of assigning a token to the user.
I as a programmer/creator don't ever want to see users passwords in raw string format. So I want to hash passwords on the front-end also. I will use Bcrypt in my React application to Hash the raw string passwords.
My concern is though that a basic hash without any salt is practically worthless in the grand scheme of things. The salting process of a hash is a bit confusing to me. A salt's purpose to add unpredictability to a password hash. I'm under the impression that when Bcrypt generates salt the salt is never the same meaning the hashed version of the password is never the same. So if I apply salt to either side of my application (Front End React / Back End FastAPI) doesn't this mean I'll never be able to actually compare them?
Or does Bcrypt know how to compare salt + hashed strings? Or is the whole point of the hashing process to simply obscure the password from physical via and in all reality I shouldn't be salting my hashes?
Seriously appreciate anyone who can help me better understand this. I'm really working toward trying to be as secure as I can with my project.
I've read over several other post on this matter, but there seems to be more focus on if you should hash or not on back ends. In all reality I think at minimum a basic hash should be applied to both ends no matter what. I do not plan to ever store or see raw string passwords in my application.