title: How should session management be designed?
body: <p>I'm looking for general advice on how to design a secure session management system.  The system I have in place currently follows <a href="http://www.technicalinfo.net/papers/WebBasedSessionManagement.html" rel="nofollow">this design</a>, but it just dawned on me how stupid it is to put all that crap in every URL, especially when you get web indexers / Google Analytics involved.  I'd hate to think that I just completely wasted my time following a terribly-written whitepaper, so I guess my question is, is it worth it to re-write my session management system, and if so, how in general should I design it?  Thanks. </p>