Client-side state is any data a web application stores in the browser or sends back with requests and then uses on the server, such as cookies, hidden form fields, localStorage, or view state. It can improve performance and keep web apps stateless, but it is still under attacker control if the browser or request is modified.
Security problems begin when a server trusts this data for authentication, authorization, workflow progress, object IDs, or cryptographic processing. In attacks, tampered client-side state can change account context, bypass checks, or feed malformed values into parsing and decryption code. Defenders should treat all browser-supplied state as untrusted, verify integrity with strong server-side validation or MACs, encrypt sensitive values when needed, and re-derive security decisions on the server instead of trusting what the client sends.