>That hasn't been an issuefor our clients, since most of their authenticated work is done with machines where they control the browser settings.

Yes, we also have no problem on a big app I support where there is support to make sure of that. The problem is with public app.

>You can use the cookieless option for forms authentication which *should* automatically add state info to the url if the browser doesn't allow cookies. I haven't tried that IIRC.

That would then be the query string method I mentioned earlier. So, someone having a Web site using a cookie approach, with consideration to get rid of cookie, would then have to go through all hits to make sure this is added to the query string. There is still the HTTP header however which I would like to hear from someone who used it before. We use it at one location for storing data to be persistent. But, I did not use it to store persisent data at first for a login user recognition.