HTTP Developer’s Handbook

Persistent Data

For data that needs to persist across multiple user sessions, the same questions must be asked as with session-only data: Which elements are sensitive and which can risk exposure over the Internet?

For data that can risk exposure, you can choose between storing the data on the server or on the client. The options for keeping the data with the client are fewer, however, because form variables are not a reliable option. URL variables can be used, but this requires the user to keep up with this information, perhaps by bookmarking a specific page. Thus, the most common option for this approach is to use cookies.

Note

Cookies are sometimes used to store information such as user preferences. Although cookies have been given a bad reputation ...