State Management in APS.NET is managed by two ways:
Client-Side or Server-Side

Client-Side:Cookies,HiddenFields,ViewState and Query 
Strings.
Serve-Side:Application,Session and Database.

COOKIE:
A cookie is a small amount of data stored either in a text 
file on the client's file system or in-memory in the client 
browser session. Cookies are mainly used for tracking data 
settings. Let’s take an example: say we want to customize a 
welcome web page, when the user request the default web 
page, the application first to detect if the user has 
logined before, we can retrieve the user informatin from 
cookies:
[c#]
if (Request.Cookies[“username”]!=null)
lbMessage.text=”Dear “+Request.Cookies[“username”].Value+”, 
Welcome shopping here!”;
else
lbMessage.text=”Welcome shopping here!”;

If you want to store client’s information, you can use the 
following code:
[c#]
Response.Cookies[“username’].Value=username;

So next time when the user request the web page, you can 
easily recongnize the user again.

SESSION:
Session object can be used for storing session-specific 
information that needs to be maintained between server 
round trips and between requests for pages. Session object 
is per-client basis, which means different clients generate 
different session object.The ideal data to store in session-
state variables is short-lived, sensitive data that is 
specific to an individual session.

Each active ASP.NET session is identified and tracked using 
a 120-bit SessionID string containing URL-legal ASCII 
characters. SessionID values are generated using an 
algorithm that guarantees uniqueness so that sessions do 
not collide, and SessionID’s randomness makes it harder to 
guess the session ID of an existing session.
SessionIDs are communicated across client-server requests 
either by an HTTP cookie or a modified URL, depending on 
how you set the application's configuration settings.

Every web application must have a configuration file named 
web.config, it is a XML-Based file, there is a section 
name ‘sessionState’, the following is an example:

<sessionState mode="InProc" 
stateConnectionString="tcpip=127.0.0.1:42424" 
sqlConnectionString="data source=127.0.0.1;user 
id=sa;password=" cookieless="false" timeout="20" />

‘cookieless’ option can be ‘true’ or ‘false’. When it 
is ‘false’(default value), ASP.NET will use HTTP cookie to 
identify users. When it is ‘true’, ASP.NET will randomly 
generate a unique number and put it just right ahead of the 
requested file, this number is used to identify users
[c#]
//to store information
Session[“myname”]=”Mike”;
//to retrieve information
myname=Session[“myname”];

this is briefly about cookies and sessions in ASP.NET

Cookies
1.	Cookies can store only "string" datatype 
2.	They are stored at Client side 
3.	Cookie is non-secure since stored in text format at 
client side 
4.	Cookies may or may not be individual for every 
client 
5.	Due to cookies network traffic will increase.Size 
of cookie is limited to 40 and number of cookies to be used 
is restricted to 20. 
6.	Only in few situations we can use cookies because 
of no security 
7.	We can disable cookies 
8.	Since the value is string there is no security 
9.	We have persistent and non-persistent cookies

Session
1.	Session can store any type of data because the 
value is of datatype of "object" 
2.	These are stored at Server side 
3.	Session are secure because it is stored in binary 
format/encrypted form and it gets decrypted at server 
4.	Session is independent for every client i.e 
individual for every client 
5.	There is no limitation on size or number of 
sessions to be used in an application 
6.	For all conditions/situations we can use sessions 
7.	we cannot disable the sessions.Sessions can be used 
without cookies also(by disabling cookies)
8.	The disadvantage of session is that it is a 
burden/overhead on server 
9.	Sessions are called as Non-Persistent cookies 
because its life time can be set manually