[davidmathers]

It's ok to have client state in cookies, just not application state.

For instance if you have a shopping cart you can have "items in cart" in a cookie because that's pure client state. You can think of the client as a resource and, say, a "view cart" page as a representation of that resource.

If the cookie in any way tells the application how to behave, then you have sinned against the gods of REST. The most common example is probably the login redirection cookie.

[mahmud]

Just store a session ID in the cookie and keep the client state on the server side, indexed by that cookie. No need to make a memory lookup into network transfer.