We're working on a mobile app and are using session tokens for authentication with a back end server. Is it a security risk to pass the session token from the client to the server in the body? This isn't for authentication, but more so just because of something we're trying to accomplish in the application. The tokens are already passed around in the headers so if someone was sniffing our traffic, then having it in the body doesn't seem like any extra risk- or am I missing something?