I am making a webview that is going to be part of a native iOS and Android app, I implemented the webview using HTTPS as a protocol, and developed my NodeJS app there.
But the security team from where I work, came with the following situation:
"what if the phone that has the app is connected to a malicious router, and redirects the URL of the webview to another IP with has a server with malicious content"
And he told me to use SSL Pinning to fix the problem, but I'm not sure that this scenario can happen because I'm using HTTPS, I believe that HTTPS only already gives the protection I need against MITM.
If the router redirects the URL to a malicious server, the server will never have access to our SSL/TLS certificate, it can self-sign one, but it will never have the CA root certificate signed, so the webview will show "This website is insecure" kind of warning.
He went on, and said that if the user has a compromised device, he can generate his own CA, and put into the client's device, so it will handshake an HTTPS connection, while I see that this can happen, this isn't MITM, and I don't know how SSL Pinning can help in this case either.
The only case I see SSL pinning being useful, is if I want to prevent my URL from opening anywhere other than the app webview, but it is the only situation I can imagine.
Am I thinking the right way here? would love to see you guys opinion in this.