We're working on a mobile app and are using session tokens for authentication with a back end server. Is it a security risk to pass the session token from the client to the server in the body? This isn't for authentication, but more so just because of something we're trying to accomplish in the application. The tokens are already passed around in the headers so if someone was sniffing our traffic, then having it in the body doesn't seem like any extra risk- or am I missing something?
You're right in assuming that there won't be any extra risk sending the token in the body when you're already sending it in the headers. I question why you would need to send the token in two places, but as far as sniffing traffic it won't be any easier for an attacker to read body traffic than header traffic. If you're sending the traffic over HTTP as opposed to HTTPS you're vulnerable to a man in the middle attack either way.
Snigging is not the only issue. What about XSS? You can not mark something as HttpOnly if it is in the body, the way you can with a cookie.– AndersOct 22, 2016 at 8:33