title: CSRF in Mobile Applications
body: <p><strong>The Situation</strong>:</p>
  
  <p>Alice uses an online banking website which stores a cookie of her credentials.</p>
  
  <p>Before the cookie expires, Eve sends Alice a malicious URL which subsequently causes Alice to withdraw money from her bank account and send it to Eve.</p>
  
  <p>This a common CSRF example for web applications, but how feasible is it to do this inside of a mobile application?</p>
  
  <hr>
  
  <p>What if Alice uses a banking application on her phone which stores a cookie and then visits a site from Eve which has a similar outcome?</p>
  
  <p>Will a cookie on Alice's mobile device from a native (or hybrid) application be vulnerable to manipulation, or are these cookies typically sand boxed on the device somehow?</p>
  
  <p>I would assume cookies on iOS, Android, etc. work the same as a normal browser, but is this actually the case?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>This question was originally meant to be generic across all mobile devices.  Even something such as creating a cookie in JavaScript and then using PhoneGap or Titanium could be relevant I believe.  After reading more into this, I'm also curious if compiling the JavaScript using one of these other technologies would affect native devices' cookies and how they store them.</p>
  
  <p>The main point of using cookies would be to maintain credentials of the user so they wouldn't have to log out and log back in every time with their bank account. After reading more about this issue, it seems like there are different scenarios for each particular device and it is in fact possible to CSRF an application.  As an example, <strong><a href="https://stackoverflow.com/questions/785973/what-is-the-most-appropriate-way-to-store-user-settings-in-android-application">Shared Preferences</a></strong> in Android are sand boxed to prevent other applications from accessing the values.</p>