Despite what another response may suggest, it is indeed possible to securely store any value on the client side. By "securely," I mean that the value is kept hidden from the client and cannot be altered. This can be achieved through storage mechanisms like localStorage, websql, or similar options. However, it is important to note that Javascript code will also be unable to access or manipulate this value, as Javascript itself is part of the client environment that you are trying to protect this data from.
If you possess a secret key on the server side, you can use it to encrypt (for confidentiality) and/or sign (for integrity) any data that is transmitted to the client. This is a common approach employed by frameworks such as Rails to manage sessions without relying on server-side storage, maintaining a relatively high level of security.
It is crucial to understand that simply encrypting a cookie on the server does not automatically authenticate its contents. It is recommended to use authenticated encryption to safeguard against potential replay attacks, for which measures like timestamps or nonces can be utilised. Furthermore, concerns such as forward secrecy should be taken into consideration if required. Ultimately, ensuring security in these scenarios can be complex, but with proper attention and effort, it is achievable.
If data is signed but not encrypted, there is still a possibility that Javascript could access it, although modifications would remain impossible.