My server is sending me access and a refresh token while logging in. Should I store them in the shared preferences of android by encrypting it? I want to know the best practice for storing these tokens as storing directly into preferences is easily hackable.
Android supports the beautiful concept of Application Sandbox, such that all the application run as a unique user and in its own sandbox. The local data storage in a non-rooted device for non-debuggable applications is normally not accessible. However, if the device is rooted the concept of application sandbox collapses and the installed application can run as a "root" user and can, therefore, access the data stored by any other application in their private directory(/data/data/package-name)
Storing the token as plaintext in the local data storage(SharedPreferences) is not a secure option since the same can be easily accessed from a non-rooted device. It is recommended that the token should be encrypted using secure encryption algorithm and secure implementation in the local data storage.
- Use secure encryption algorithm such as AES-GCM-256 or ChaCha20-Poly1305 etc.
- Use PBKDF2 for key derivation.
- If required store the encryption key in the Android Keystores.