javascript - Bcrypt not that secure at hashing passwords? -

i using bcrypt generate salts , hash passwords, not think doing securely. when use following code:

bcrypt.gensalt(10, function(err, salt) {   user.salt = salt;   bcrypt.hash(password, salt, function(err, hash) {     user.hashed_password = hash;     console.log(user.salt);     console.log(user.hashed_password);     user.save(function(err) {       if (err) console.log(err);       console.log("saved");     });   }); }); 

in 1 example, salt is: $2a$10$mffjrpy1vrq7fy1ffp0fmo , hashed_password is: $2a$10$mffjrpy1vrq7fy1ffp0fmovnlv9ckgafdcq5xdtlp6uokz90i1fmu

the beginning of hashed password exact same salt. if attacker has access salt, can't remove salt hashed_password , either brute force or use table of predetermined hashed values determine password?

i thought should order of hashing password:

hash(salt + password) 

not:

salt + hash(password) 

the beginning of hashed password salt because need access salt in order verify password.

the data see neither hash (salt + password) nor salt + hash(password) -- of form

salt + hash(salt + password) 

if attacker gains access data, then:

• they can of course (theoretically) brute force password -- no technique can prevent this, rate limiting renders attack impractical. hash function used in instance designed take long time run, indirectly rate limiting attack.
• they cannot use standard table of hashes find out password -- that's because hashed value contains unique salt. of course salt out there in clear table can calculated, since salt unique each hashed password no better brute force attack.