Re:Is it OK to hold credit card numbers in cookies, Santander?
by phil on Monday October 15, 2012 @05:15PM
(#4657196)
The advantage -- and it's often a big one -- is that you don't have to have a corresponding server component to translate session id to session state. The state is all in the client.
Edit: wouldn't have written this if I'd seen FooBarWidget's more detailed remarks first.
Re:Is it OK to hold credit card numbers in cookies, Santander?
by nessus42 on Monday October 15, 2012 @08:28PM
(#4657822)
The session information is cryptographically signed, so you don't have to trust it! These stateless server frameworks are just using the client as a state cache.
Edit: wouldn't have written this if I'd seen FooBarWidget's more detailed remarks first.