I have been pen testing an android mobile application for security vulnerabilities. As part of the test, I started Frida server on a mobile phone where the mobile application to be tested is installed, running, and after login (Already inserted credentials and logged in). While being logged in the application, I dumped the application's memory using Frida (with strings), and was able to find my session token in clear-text JSON format.
I was wondering, is there any way to mitigate this vulnerability? Of course it makes sense that the session token is saved in memory, but is there a way to store it securely (E.g. not in clear text) and thus mitigate such a vulnerability?
I find this issue risky as if the mobile device is rooted, a malicious mobile application (running with sufficient permissions) can conduct the same attack locally on the mobile phone and thus extract the session token.