 <p>You sound as though you are "rolling your own" authentication system.</p> <p>I would look into using ASP.NET's built in <a href="http://msdn.microsoft.com/en-us/library/xdt4thhy.aspx" rel="nofollow noreferrer">Forms authentication</a> system that is commonly used with an ASP.NET <a href="http://msdn.microsoft.com/en-us/library/aa478949.aspx" rel="nofollow noreferrer">Membership Provider</a>. Built-in providers already exist for SQL Server, and you can create your own Membership Provider by inheriting from the <a href="http://msdn.microsoft.com/en-us/library/system.web.security.membershipprovider.aspx" rel="nofollow noreferrer">System.Web.Security.MembershipProvider</a> base class.</p> <p>Essentially, the ASP.NET membership providers usually work by setting a client side cookie (also known as an Authentication Ticket) in the client's browser, once the client has successfully authenticated themselves. This cookie is returned to the web server with each subsequent page request, allowing ASP.NET, and thus your code, to determine who the user is, usually with a single line of code like so:</p> <pre><code>string username = HttpContext.Current.User.Identity.Name; // The above gets the current user's name. if(HttpContext.Current.User.Identity.IsAuthenticated) // Do something when we know the user is authenticated. </code></pre> <p>You then should not need to store anything in the Session state. Of course, if you <em>want</em> to store user-specific data in a session variable (i.e. user-data that may not be part of the authentication of a user, perhaps the user's favourite colour etc.) then by all means you can store that in a session variable (after retrieving it from the DB when the user is first authenticated). The session variable could be stored based on the user's name (assuming unique names) and retrieved using code similar to the above which gets the current user's name to access the correct session object.</p> <p>Using the built-in forms authentication will also allow you to "protect" areas of your website from un-authorized users with simple declarative code that goes in your web.config, for example:</p> <pre><code>&lt;authorization&gt; &lt;deny users="?"/&gt; &lt;/authorization&gt; </code></pre> <p>Adding the above to your "main" web.config would ensure that none of your pages are accessible to un-authorized users (though you'd probably never do this in reality - it's just meant as an example). Using the ASP.NET <a href="http://msdn.microsoft.com/en-us/library/aa479032.aspx" rel="nofollow noreferrer">Role Provider</a> in conjunction with the Membership Provider will give you even greater granularity over who can or can't access various sections of your website.</p>