The humble cookie. So controversial. So complex to secure. If your web app must have them, you must secure them.