One of our clients has an issue with a government security audit on one of their mobile applications.
The finding states that the application stores session cookies on the device in clear text format therefore on a rooted device it is theoretically possible for an attacker to steal the session cookie while it the session is active and perform transactions on behalf of the victim (provided they can also bypass the root detection mechanism in the application itself).
My questions are:
1) Is this a valid finding?
2) If the application encrypts/decrypts the cookie on the device storage does this add more security or not because the application will have to store the key inside it?
3) If the application will encrypt cookies does this mean it will be the same key for all devices obfuscated in the program code or it will be a combination of a key with random data generated on first run to have a unique key for every device and at the same time not have a standalone key stored with the data itself.