That is one option, but you can also architect the system such that the client holds most of the state either in the URL or in a hidden field (signed by the ser

That is one option, but you can also architect the system such that the client holds most of the state either in the URL or in a hidden field (signed by the server to prevent tampering, and optionally encrypted). You'll still need the server to track some aspects of the session, for example to prevent accidentally submitting the same order multiple times.