Server state is data that lives on the remote side of an application, such as API responses, user records, session-linked data, or feature flags. In tools like TanStack Query, this state is often fetched from the server, cached on the client, and refreshed when it may have changed.
It matters in security because server state is usually shared, authoritative, and sensitive to context. If a cache is scoped too broadly, one user can see another user’s data. If refresh logic is weak, an application may rely on stale permissions or outdated records. In server-side rendering, poor request isolation can also cause cross-request leakage when cached data is reused between users.
Defenders protect server state with per-user cache keys, strict invalidation, short-lived secrets, and clear boundaries between requests, sessions, and environments. In practice, the main risk is not the data itself, but how it is fetched, stored, and reused.