Social Media app how to correctly save login

Question

I am coding an Android Social Media app, The frame is in Java and the actual data is just a WebView of the mobile view of my social media site.

The question I have is how do I save a user's password, is there anything wrong with storing the user's password in plain text (Not hashed or anything) in a file since using Internal Storage on an Android device means only my app can access the files?

Also when displaying the user's data such as activity, profile data, and feed (Which is all a HTML webpage) would it be safe to code the website to take URLs like www.mywebsite.com/mobile.php?user= example &session= String Of Characters

Answer 1

There is no issue in writing the password in SharedPreferences or internal storage as users can't access it until a device is rooted. The best approach is that you should save encrypted password or authToken instead but if you want to proceed with plain text password then apply a special check that if a device is Rooted then don't save password in plain way.