I am developing a modification for a game server. The mod hosts a SocketServer which clients can connect to using a smartphone app, allowing them to chat with other players whilst not physically playing on the server.
In order for a client to connect through the smartphone app, they must present an access token in the Authorization header which has been obtained previously (not relevant for this question).
Game server admins are required to install and setup my mod. I am wondering whether it is necessary for me to require admins to go through the process of obtaining a certificate for use with my modification (which some won't be able to do due to limited command line access), when I believe the advantages of doing so are limited.
The connection itself is not being used to send/receive sensitive information. However, if the access token is somehow obtained by a hacker, it would allow the user to establish a socket connection to my modification, and impersonate that user in a public chat (not private messages).
Users of the service will establish a connection to the WebSocket server through a smartphone app. When they receive their access token used to connect during handshake, it is stored securely with the iOS/Android Keychain mechanism.
My understanding is that because the connection originates from a smartphone, the likelihood of a hacker being able to convince a victim to install some form of malware on their phone that can steal their access token is just not plausible (especially considering the traffic is not really sensitive). I am also thinking that with this being a small-time hobbyist mod, the likelihood of a proximity based attack is minimal.
I am by no means an expert in network security, and would appreciate guidance on whether these assumptions are correct.