This looks very much like the approach to session-data-in-encrypted-and-signed-cookie I've seen used to great success in lots of places (where for a stateless-i

This looks very much like the approach to session-data-in-encrypted-and-signed-cookie I've seen used to great success in lots of places (where for a stateless-ish API the contents are just a user id or whatever). Am I right that this would work fine both in that or in e.g. a query parameter? (sorry if I'm asking really stupid questions, but I'd rather look stupid than accidentally a security hole)