Correct. The server should be storing the password hashed as Hash(Password+Salt) to make it impractical for an attacker to recover the user's password. Recover

Correct. The server should be storing the password hashed as Hash(Password+Salt) to make it impractical for an attacker to recover the user's password. Recovering whatever the server has stored is typically going to be sufficient to authenticate the user, but storing it as a hash mitigates some threats.