Say I have a web application using ajax httponly cookie for login session(token) storage. I wonder if I embed my web app into a native client(android or ios webview), does secure cookie stay unreadable anyway? Because I just came to know Android has CookieManager which is capable of reading cookies from webview.
The main problem is, I want to store user access token into cookie or somewhere in the user browser. I want to make sure no matter which environment (ordinary chrome or safari, or in native-app webview) user is in, stored user token stay secured and unreadable for XSS or any other hacking attack. Is there any way to accomplish this?