4 ms·

"Never trust the client"

• nessus42 14y ago
  The session information is cryptographically signed, so you don't have to trust it! These stateless server frameworks are just using the client as a state cache.