-
Type:
Story
-
Resolution: Unresolved
-
Priority:
Low
-
Affects Version/s: None
-
None
Multiple issues have been identified in the current login and session handling flow, indicating the need for improved login functionality and security implementation:
- Username and Password are being stored in Preferences in plain form, which is a security vulnerability.
- User is automatically logged out aftersome time without proper session handling logic.
- On relaunch, the app prompts for biometric authentication and logs the user in directly without validating JWT/Refresh Token.
- Even when "Remember Me" is turned OFF, Username and Password are still being saved in Preferences.
- "Powered-By" line is not centered.
Expected Behavior:
- Sensitive data like Username/Password should not be stored in plain Preferences (should use secure storage or token-based approach).
- Session management should rely on JWT/Refresh Token instead of hard logout timings.
- Biometric login should validate against a valid session/token, not bypass authentication.
- "Remember Me" functionality should strictly control whether credentials are stored or not.