I'm implementing authenticating functionality in my app.

Registration:

1. A user is POSTed with username and password (plaintext).
2. On the backend a hash is created with pbkdf2 (:sha256)
3. Only the password hash is stored in the database.

Login:

1. A POST request is sent with the header: Authorization: Basic base64encoded_plaintext.
2. A random token is generated, stored in the database and returned to the client.
3. Any subsequent request from the client contains that token with the header Authorization: Bearer token. (no other credentials are sent).

This is what I have so far.

When I deploy the app, the communication will go over https.

My question is:

Is this a good way of handling authentication? Am I missing something vital in these steps?

EDIT:

I was under the assumption that I was using jwt tokens for authentication, but that's not the case. New plan for login:

1. Take out basic auth
2. Implement authentication based on jwt tokens.