Browsers are the ones in charge of sending the cookies, based on how you configured the cookies, as per the link I shared about Restrict access to cookies, but on a mobile app would be the developers responsibility to manage cookies, or have a library to do so.
From my limited knowledge on browsers inners, this would be a violation on how browsers security should work. Can you point me to some documentation on this?
Ah, I think I get you now. If the Javacript is from the same-origin then you can configure it to send the cookies, but if the Javascript isn’t the browser cannot send the cookies, otherwise it would break the fundamental security of how this was designed to work.
As I mentioned in my answer you can use whatever you want, the problem is to keep them from being extracted and reused outside the original client, the web or mobile app. Also, if you use cookies in a mobile app how will you establish trust on the very first API request? By other words how would you know that what is making the request is indeed the genuine and unmodified client of your backend?
it’s always a problem, no matter if the backend is only for web or for mobile or for both. The backends are blind when it comes to attest with an high degree of confidence that a request is indeed from what it expects, a genuine and unmodified app that the backend is allowed to serve request for.
For mobile apps
I recommend you to read this answer I gave to the question How to secure an API REST for mobile app?, especially the sections Hardening and Shielding the Mobile App, Securing the API Server and A Possible Better Solution.
For web apps
You can learn some useful techniques to help your API backend to try to respond only to requests coming from what you expect, your genuine web app, and to do so I invite you to read my answer to the question Secure api data from calls out of the app, especially the section dedicated to Defending the API Server.
