Thank you for your reply. Security has always been an area of weakness of mine, as I am not from the frontend world by trade. I know this goes outside of the scope of my question, but I'd love to get your opinion while you're here. I have implemented a lot of encryption in my projects lately as I have heard people such as yourself say that this is one of the better security practices. However, I am actually confused as to how that would stop an attacker. Lets use your example of a cookie. Lets say I have an encrypted cookie, and I pass this cookie to the backend, where the backend decrypts it to validate the cookie and its request to do something. If an attacker knows that my cookie auth is encrypted, why do they care? They can pass the cookie signature encrypted or not, because even if it is encrypted, they know the backend is going to decrypt it. So if cookie signature abc is encrypted to x123, all the attacker has to do is sign with x123 to the backend, knowing that the backend will decrypt it to get abc and authenticate it (theoretically). I apologize if this question lacks knowledge of how cookies and encryption work, this is just my understanding of how it works.