But it seems to me that ReST <i>does</i> dictate, specifically, that there must be no need for shared state. The system <i>must</i> work without the client having knowledge of the server and vice versa. But a cookie, as used to hold a session token which references information on the server, is very much shared state. So should be forbidden.