Question on password hashing security

Question

I'm about to add some user account and password functionality to my software, so I'm reading about password hashing.

So my understanding is Hashing is a one way function, and it works like this:

1. User Bob Types in password box: “MyPassword”
2. Request Sent to server for Bob’s Salt, and hash from database: Hash: 8912ep98as89uasdp Salt: 89asdjklasdo11jdsa
3. “MyPassword” + Salt is hashed using same function and compared to retrieved hash
4. If they match access is granted.
5. The hash is stored in application memory for future comparisons.

Is that accurate? So that above has granted the user the ability to click around the application, but say my application is retrieving data from a server. I want things to be secure, so for each request from the service I pass along the authentication details (stored hash from step 5), and the service checks it against the database hash before returning a set of data.

Isn't knowing the hash kind of just as bad as knowing the password? If you found out the hash, you could use the service for nefarious means because all the password is used for is generating the hash, and the hash is used for all further authentication.

Edit, for clarification, this isn't a web app. It's going to be a WPF application, probably using WCF service to talk to a server.

Answer 1

Use a session cookie. Use an existing and proven design for session authentication. You will likely find the Information Security stack exchange helpful.

One of the key lessons of computer security is that when you invent it yourself, you're building in security holes. Improved treatment of this problem is one of the key things that differentiates Bruce Schneier's book Cryptography Engineering from the book it replaces, Practical Cryptography.

Further reading:

1. https://www.sans.org/reading-room/whitepapers/webservers/authentication-session-management-web-1545
2. https://www.owasp.org/index.php/Session_Management_Cheat_Sheet

This question also partially duplicates Authentication, Authorization and Session Management in Traditional Web Apps and APIs over on stackoverflow.