I stumbled over this in the ASVS 3.0.1 (V3.6). I wonder what this is, I couldn't find any meaningful explanation.
This seems likely to refer to the practice simply writing session tokens into the URL as part of a GET request in the form of SomeAction.do;jsessionid=863F3D24DEFA?Id=19. This is obviously bad practice and not advised.
It's not entirely clear what is meant without some kind of example, however I would speculate that this means, "Never store URL parameters in cookies." Doing so would potentially open a site up to lots of XSS vulnerabilities. If you're doing this with session variables, then a session could possibly be hijacked simply with a copied URL.