My company has a travel app which helps you buy tickets for work related travels. When you need to travel you enter your details on SAP and it it sent to your manager for approval. When it is approved, you open the travel app. The app sends a request to the SAP system and gets your confirmed travel details with your personal info. All data is then base64 encoded and sent to the browser in a cookie. This cookie goes with all requests. I objected this architecture because the cookie contains sensitive data. I suggested we keep a session in the travel server and retrieve the sensitive data when needed but developers don't want to do that. They say it requires too much effort. Is there a more secure alternative to this design where we don't keep the sensitive data in a cookie?