Which might not work if a user has disabled cookies in his or her Web browser: application state or session state?

Answer:

Session state, by default, won’t work if a Web browser that supports cookies
has cookies disabled. Application state isn’t user-specific, though, and doesn’t need to be tracked in cookies. Therefore, application state works regardless of cookies.