I am converting my web application Ubiqer.com to a mobile app. I am currently using CodeIgniter 4 with jQuery and sessions to maintain state. I understand that my controllers need to return JSON responses to support the mobile app, but I have a few concerns:

• CSRF Protection: My web application uses CSRF protection, where CodeIgniter sets a token in an input field and also in a cookie each time a form is submitted. How can I handle CSRF protection when my frontend and backend are on different domains?
• Session Management: Is it possible to use server-side sessions for a mobile app? If so, what major challenges might I face in implementing this?

My solution was to use JWT token for authentication and using rest apis for the backend. But this will increase the development cost & time. For now we just want to have a mobile app.