If we want to allow sensitive data between a web server and specific client only, is there anything more that can be done besides the following?
Note that this is potentially a duplicate of Authenticating client without hardcoding key? but the focus here is more on a good solution within this limitation (that there is no absolutely definitive solution to authenticate the client)
1) All traffic flows over SSL
2) Client has AES-256 key hardcoded yet obfuscated
3) Server has same AES-256 key
4) Client makes request for new "session key"
5) Server generates random session key and encrypts it with shared AES-key
6) Client decrypts, and all further exchange happens over this "session key" (which is also aes-256)