In a typical server-backed web app architecture, TLS is the protection against MITM. You're gonna have a really really hard time making something which protects

In a typical server-backed web app architecture, TLS is the protection against MITM. You're gonna have a really really hard time making something which protects against MITM better than TLS. There are things you can do to make it more difficult to hack your TLS connection though, for example you could use key pinning to make sure that your app will only accept a server with the certificate you expect. This would protect against an IT admin installing root certs on their users' devices, or against certificate authorities issuing fake certificates for your domain.