I have been reading up on Forms Authentication and get the impression that to use this form of authentication the user must have cookies enabled.

Is this correct and if so what exactly does it use the cookies for ?