While looking at Spring Security DaoAuthenticationProvider implementation I noticed that credentials are stored as Strings. Like in an example below:
String presentedPassword = authentication.getCredentials().toString();
that can be found here: https://github.com/spring-projects/spring-security/blob/main/core/src/main/java/org/springframework/security/authentication/dao/DaoAuthenticationProvider.java#L75
From what I've learned a good practice is to handle passwords as byte arrays due to Strings immutability. Is there something I am not aware of regarding Strings security in Java?