title: Storing sensitive information in session
body: <p>We are developing a banking app where a sensitive information field would need to be required to be stored in session. (not all sensitive info field, just one).</p>
  <p>EDIT: By session, we dont mean in a cookie. Its in the back end session attribute of the application. By the way our app is Java Spring MVC</p>
  <p>My question is, from a security perspective, do we still need to encrypt these info when stored in session? We are using HTTPS anyway.</p>