I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used.
Some options came to my mind:
Store the password encrypted using public key cryptography, so only the server can decrypt it and perform authentication. However, I understand it's a bad practice that in the event that password gets compromised, the entire suite of applications using the SSO would be compromised.
Use Client Certificate based authentication... Does it make sense?
Are there other choices?