I have a client (a mobile app) and a server, the app connects to the server via SSL.
The server uses a self-signed certificate, and the client has a file (I'm not entirely sure what, something to do with bks and hostname verification) that validates the certificate.
From what I've read this should prevent MITM attacks, in which case apart from physical access to the client or physical access/hacking the server means the session token is impossible to get to use in a replay attack.
Because users don't want to want to log in even once a month, the token lasts forever (unless they log out or log in on a new device), I can only think of one way around this, which is with every request a new token is returned, but then an attacker might be able to steal the victims session.
1) Does a self-signed certificate with some sort of validation on the client (assuming neither have been tampered with) protect against MITM attacks?
2) If not, is it possible to prevent replay attacks with persistent session tokens or stop hijacking if tokens are renewed constantly?
I'm not worried about tampering on the client side as the data as although the users data is private it couldn't be used to cause any more damage.
EDIT: To clarify, I mean replay attacks using the session tokens, basically I'm trying to find out if using SSL (to stop attackers from getting the session token) is enough to prevent replay attacks, or whether I need additional validation on the session tokens/clients, and if so what?