[jameshart]

How does the server verify that the salt it receives in the second request is the same salt it generated in the first response? Does the server have to retain state?

Also you should maybe read https://benlog.com/2008/06/19/dont-hash-secrets/

[bullen]

Servers are stateful.