On 5/13/05, Bruce Butterfield bab@entricom.com wrote:
Eric Merritt wrote:
As for storing system data on the client, that's never a good idea for reasons I hope are obvious.
Agree about system data but it does bring up the interesting arguments about REST-ful (read highly-scalable) web applications where state maintenance is pushed onto the client vs. server sessions. I realize this is a bit off-topic but I think that continuations (suitiably sped-up and obfuscated, perhaps?) on the client side could be a reasonable design for future applications.
Trusting data (much less code) to the client is just not safe. Theoretically you could encrypt the data and trust the returned data, but there are any number of places where that particular path could (and will if the target is attractive enough) will fail. By storing data on the server and only associating it with a client you remove a whole class of possible security issues. I don't believe that the benefits of storing state client side outweigh the steps that would need to be taken to ensure security.