Hacker News Reader

I don't understand. Why isn't the session cookie created at initial load, and then all the data in the session kept on the server side? Writing anything into a cookie except the session id seems weird to me. What am I missing?

View on HN

By default Phoenix uses client side sessions. The session data is written into a cookie and signed (or encrypted) to prevent tampering.

Signed cookies are vastly simpler to scale. It’s a common enough problem that frameworks default to them.

Reply on news.ycombinator.com