A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the service side.
Problem / Security Threat:
The WebView element of the android and iOS plattforms allow to create a malicious web browser that unveils and modifies session cookies.
So far I have no idea how I can prevent an attacker from creating und publishing such a malicious mobile application, as well to prevent the service from beeing accessed via malicious mobile applications. I know about the existence of the
User-Agent header and that the service can use this information to reject requests from others than specific browsers. But I'm sure that also this header can be manipulated within the WebView.
What are effective countermeasures aginst CSRF in contex of malicious mobile applications?