I think for most public web sites, keeping sessions in a LRU cache like memcached shouldn't be a problem, since it automatically purges the relatively inactive

I think for most public web sites, keeping sessions in a LRU cache like memcached shouldn't be a problem, since it automatically purges the relatively inactive sessions. Assuming each session uses up 100k, which is a lot if the user is not writing a novel, you can still keep 10,000 active sessions in 1GB of memory. If you think the sessions are purged too early, you can add more ram, or more boxes, since memcached is distributed. Last I checked facebook had a 3TB memcached cluster. But ya, if the sessions are small enough you might as well pass them to the clients.