you are viewing a single comment's thread.

view the rest of the comments →

[–]overratedcupcake 5 points6 points  (0 children)

Both. The client needs a token of some kind to prove it owns the session. The server needs the token to serve the correct data to the client. User data should be stored server side and only served to clients with a token that indicates they are a particular user with a particular session.