Re^3: If you do away with server-side state, you don't need cookies

[adrianh]

Not really. The complete-state-in-a-form method allows for easy session forking. It also allows users to undo state transitions by backing up into the browser history. Cookies don't support either of these.

Session forking isn't that hard with IDs (whether cookie or URL based). Just have the ID index into a tree of state transitions on the server side. It's something I've done on several sites (and I've a vague memory that somebody has implemented a CPAN module that makes doing this fairly simple, but am to lazy to go find it :-)

Keeping the state server side can be handy, and having a small ID means I can stick it in a URL and have a more RESTful bookmarkable API.