Comment by aeonik

This is incorrect implementation fyi.

You are supposed to send the password, via TLS so it's not in the clear, to the server to be hashed.

If you hash on the client... then the hash essentially becomes the password, and defeats the purpose of a hash. I could just steal the hash and use it.

The name of this vulnerability is "pass the hash"