[brown9-2]

What is the point of generating this value on the client? The second scenario you describe seems to work the same, minus the need to generate values on the client, with the same outcome.

[scotty79]

I guess no point. Pick the one that you feel better with.

[scotty79]

Also the server should keep it hmac-ed in case db silently leaked.