Definitely use cookies. Opaque tokens. Works great. All the good versions involve cookies somewhere - they’re the most resistant to all the various forms of at

Definitely use cookies. Opaque tokens. Works great. All the good versions involve cookies somewhere - they’re the most resistant to all the various forms of attackers on the web. Many use cookies in order to stamp short lived tokens, though.