They're implying that you are storing state in the client which sends that state back to your system in subsequent requests, e.g. an HTTP cookie. If doing so, make sure to use a MAC [0] to tell if the client has tampered with the state you stored.
[0] https://en.wikipedia.org/wiki/Message_authentication_code
Re:Five Minute Guide to Software Security
by zzzcpan on Friday October 13, 2017 @06:04PM
(#15469533)
Presumably, if you don't want to store some state on the server for a client, you can go stateless and store it only on the client but with MAC, so you can authenticate it. For example for session cookies.
> If a stateless architecture being used, use a MAC or an authenticated encryption mode to authenticate input.
I ask as a developer of a SaaS product. I understood most of the tips but not this one.