Client-side sessions versus server-side sessions

[toraritte]

To digest:
http://phillbarber.blogspot.com/2014/02/client-side-vs-server-side-session.html

(Related to #19 )

[toraritte]

Keep this in mind:

https://security.stackexchange.com/questions/115695/when-should-server-side-sessions-be-used-instead-of-client-side-sessions

Before you create client side sessions, you should ask yourself if you really need it (which may be the case if you have multiple servers which need to share the same session state, eg for scalability reasons). Session data is traditionally handled server side for a reason: It contains data that the client should not be able to read or change. That's easiest to do by just not sending it to the client.

Setting up a complex system to store session data client side is difficult, and a lot may go wrong doing it. If it's not necessary, just store the data server side.