A server-side repository (like a database or session store) keeps the actual sensitive data secure on the server, only transmitting a reference key. This is safer than cookies, URL parameters, or hidden inputs, which are exposed to client-side risks and logs.