Generally speaking when it comes to any client-server communications, nothing stored on the client can be trusted to be unaltered out of band from your applicat

Generally speaking when it comes to any client-server communications, nothing stored on the client can be trusted to be unaltered out of band from your application logic. There are very few situations in which I'd store anything on the client other than a basic session id representing server-side state.