[gnaritas]

As long as you encrypt it, sure you can. It's no different than storing the session pointer in the cookie.

[oceanstone]

Though, with every HTTP request, the client will be uploading the entire cookie. This could manifest as degraded responsiveness, especially for mobile devices.

[gnaritas]

That's the trade you make when using cookies. Nothing new there.

[ExpiredLink]

Encrypted cookies? Just what hackers have been waiting for.