Using our current scheme, the digests created by the client are stored directly in the database. Now, if hackers were to gain access to the database server, they would be able to authenticate as any user. Furthermore, since the attacker would have both the digest and salt, they could potentially brute-force a user's password.
One way to mitigate this issue is to use a pepper—a variation of a salt, with the following differences:
- The pepper is not public
- The pepper is not stored in the database, but on another application server, so that the pepper is separate from the salt
- The pepper may be a constant that's set in the application server as an environment variable
Here's how the authentication method would work with the ...
