If the state cookie is generated by the server, then the best thing to do is to encrypt all application state cookies, and include an expiration time in them.

If the state cookie is generated by the server, then the best thing to do is to encrypt all application state cookies, and include an expiration time in them. Also, consider whether you want to allow the user to share the URI or not. If not, then you need to always check that the user is authenticated as whatever you wrote in the state cookie.