If your web server is part of a server-farm or you want additional security/control, then you can use web.config and SQL Server to store user session information in SQL Server.