As an example, if I am building a web application using AngularJS that stores sensitive user information such as credit card numbers.
I am contemplating what security measures I should implement. Security is not my area of expertise so I feel lost when it comes to this issue. Some of the requirements I have identified include:
- The client side is never fully secure, so the server must validate user identity independently.
- The server cannot store passwords in plain text in the database, instead it must use irreversible transformations.
- Sending passwords over the internet is insecure, so the server cannot request the original password from the user.
I am currently puzzled because these requirements appear contradictory. I need to perform irreversible transformations on user passwords, but since the server cannot ask for the original password, the transformation would have to be done on the client side. However, trusting the client side could potentially expose vulnerabilities to hacking.
Are there any established security protocols or frameworks that address the concerns I have raised?