I am developing an online tool that features various modules, including settings for language, color schemes, timers, scoring, and more. However, I am facing challenges regarding the persistence of these configurations.

I have already implemented cookies to save these settings, but I’m concerned about sensitive data. For example, regarding the scoring system, I’ve encrypted the score values to prevent users from simply modifying their cookie to “99999” to max out their scores on the site.

Hosting these sensitive elements on the server might not be an option since I do not want to include a database for such basic features in the MVP, but I also wish to avoid any possibilities for arbitrary changes.

When users accumulate points, they unlock additional colors. How can I securely save this information—that they have unlocked the colors—without allowing them to simply copy and transfer the cookies to others?

In essence, my question is: How can I securely host sensitive information (such as site points and unlocked items) without overly complicating the MVP?

Already implemented: UUID, js-cookie, crypto-js, cookie-parser