FREE The web stack LESSON · The web stack
Treat state as a distributed contract
Identity, caching, consistency, and browser security
A web application distributes state across browser, edge, service, and storage boundaries.
Cookies, tokens, URLs, caches, local storage, server sessions, and database rows each have different authority, visibility, lifetime, and consistency. The browser attaches ambient credentials under defined origin rules; intermediaries may reuse responses; retries may duplicate writes. Correctness begins by naming the source of truth and the contract for every copy.
A state bug is often two components disagreeing about authority, freshness, or identity.
Convenient browser state can become an authority leak.
Secrets in local storage are reachable by injected script; overly broad cookies ride requests automatically; query parameters enter logs and referrers; client-side flags can be modified by the user. Keep authorization on the server, constrain cookie scope and lifetime, apply CSRF and origin defenses where relevant, and treat browser data as attacker-controlled input.
The client may present evidence; the server decides permission.