title: Why do people recommend to do server side storing of session data when we can sign and encrypt session instead?
body: <p>Why do people recommend to do server side storing of session data if we can sign and encrypt them? </p>
  
  <p>I mean isn't it almost impossible for there to be any security problem if we sign and encrypt them (therefore can just store all data in the session cookie)? Am I missing any security problem here? What else should I consider?</p>
  
  <p>In short, I am asking about the pros and cons of session data storage at server side vs encrypting session cookie.</p>