Where the session lives
One design stores a session id in a cookie and the session data on the server. Another puts the signed session data itself in a token held by the client.
What does the second give up?
One design stores a session id in a cookie and the session data on the server. Another puts the signed session data itself in a token held by the client.
What does the second give up?