I'm looking at a web application that does something I find very unusual in the handling of login sessions.
The application hashes the password with SHA256 and salt and saves it either in session storage or in local storage in the browser (depending on if the user wants to stay logged in permanently). It also uses a proper hashing for passwords again on the server side (PBKDF2) and the application is served via HTTPS.
This approach seems more dangerous than storing a random value for identifying a user session, but I have some trouble to think of ways to attack this that actually pose a serious danger. There is the potential that someone that gets access to this value could brute force the password, but an attacker that gets to that point can already cause serious damage and probably get the password in other ways as well. To convince people to change this I probably need better arguments than this.
What specific disadvantages has this approach compared to the typical approaches for session storage?