Nicholas, session variables are OK, but keep in mind some issues, like a session timing out (though you can configure that).

Some people run into issues when using session variables in hosting environments.

Assuming you're using ASP.NET 2.0, there's native support for storing sesson variables in a SQL Server database (assuming you're using SQL Server).