javascript - Is my authentication system secured? -

i want implement authentication system following practices, want simple possible , secured (im not going implement magic hashing function or feel hero..) wanting use known hash not sure right way of using it. read articles on how lastpass (a password management company) mange handle authentication , loved idea.so wanted implement own authentication based on it.

basically im creating authentication key password on client side (so password never sent plan text server). authentication key im sending server hashing operations in server side , compare result 1 inside database.

on client side:

auth_key = pbkdf2(sha256, password+username, last_login_fe_salt, fe_rounds) 

explanation - hashing password+username+last_login_fe_salt text fe_rounds times

last_login_fe_salt -> random salt sent user once he/she input username in text field - honest, not sure how last_login_fe_salt efficent cryptography against dictionary attacks atleast 2 people having same password send different hashes on network. hacker can data asking server, can add server side limitations (req/s if makes difference etc.. let me know think) adding captcha might idea. when user logged in successfuly server generates new random string , saves in database.

*i didnt see explanation salt lastpass uses on client side hashing, using pbkdf2 algorithm needs salt parameter.

fe_rounds -> number of rounds given server when typing username - fixed , configurable server, in articles read lastpass dont explain receive client side number of rounds...

so send auth_key server...

on server side

now creating new hash compare 1 inside db. why hash? if understand correctly bind hash server side data, combination of password (that user knows) , server data.

db_auth=pbkdf2(sha256, auth_key, user_be_salt, 100,000+user_configurable_rounds) 

user_be_salt -> random number saved in db known server , ones obtain database, changes on every successful login.

user_configurable_rounds -> number of iterations, every user can choose amount of iterations (like in lastpass) attacker need guess number or iterations?

i happy hear think authentication system, if wrong explain me why , tell me lastpass because did not understand entire authentication flow.

most of you're doing useless security perspective. lastpass has unusual security requirements -- don't treat them source of best practices.

if client responsible hashing, , of parameters hashing fixed, the hash becomes password. attacker doesn't need know original password; can pass hash server.

generally speaking, there no way verify password on network without either sending password across network (for traditional password authentication protocols), or having server store password in plaintext (for less commonly used protocols srp). of two, former preferable, it's possible secure password in transit using protocols ssl/tls, whereas protocols srp require plaintext of password operate.

tweaking pbkdf round count, either on client or server side, pointless. set fixed round count makes hash slow, not slow place undue load on client or server. (100,000 rounds excessive server-side hash. takes half second verify password settings, 2 login requests per second use 100% of 1 core on server!)