The iOS device allows application to store cookies which could be created by the URL loading system orHTTP request by web view.
The cookies are stored in the device storage and an attacker with physical access to the device can steal the cookies.
