That issue is solved by simply having "hash(password+salt)" the thing the server has stored and is checking. In other words you can combine salts + hashes + no

That issue is solved by simply having "hash(password+salt)" the thing the server has stored and is checking. In other words you can combine salts + hashes + nonces to both eliminate the server's need to know the password and the possibility of a replay attack.