Auto-login stores the raw password instead of the JWT

[CanReader]

CredentialStore saves the user's actual password for auto-login, rather than the token the server hands back:

private static final String KEY_PASSWORD = "password";
...
public void save(String username, String password) {
    ...
    prefs.edit()
            .putString(KEY_USERNAME, username)
            .putString(KEY_PASSWORD, password)
            .apply();
}

It is at least stored in EncryptedSharedPreferences, so it's not sitting in plaintext XML, that part's fine. The issue is storing the password at all. The server already issues a JWT on login (login returns a Token), and that token is the thing meant for "keep me signed in". Persisting the raw password instead means:

• Every launch re-sends the password to log in again (see below re: it going over cleartext).
• If the encrypted store is ever compromised (keystore downgrade, a rooted device, a backup), it's the actual password that leaks, and people reuse passwords across services. A leaked token is scoped and expirable; a leaked password is not.

Better to store the issued JWT and auto-login with that, falling back to the login form when it's expired.

File: android/src/com/focus/kingdom/auth/CredentialStore.java (whole class), plus the auto-login path in Enterance that calls it.