I am designing a login system for a project, and have an issue about it requiring two trips to the database when a user logs in.
- User types in username and password
- Database is polled and password hash is retrieved for comparative purposes (first trip)
- Code tests hash against entered password (and salt), and if verified, resets the session ID
- New session ID and username are sent back to the database to write a row to the login table, and generate a login ID for that session.
EDIT: I am using a random salt.
Does this design make sense? Am I missing something? Is my concern about two trips unfounded?
Comments and suggestions are welcome.