If you’re validating client url state against server session state that kind of defeats the purpose of trying to put all the state in the url. You’re technical

If you’re validating client url state against server session state that kind of defeats the purpose of trying to put all the state in the url. You’re technically correct/sounds like you agree it’s still a bad idea, even if there’s a way to duplicate certain state for validation and make it work. Staying shackled to the earth via stupid rules of thumb like minimizing client state in banking apps does keep you from flying straight into the sun, though, which is nice.