I use Rails' standard cookie sessions. There's never much data in the session, and it's encrypted so there aren't really security concerns. Not having to bother

I use Rails' standard cookie sessions. There's never much data in the session, and it's encrypted so there aren't really security concerns. Not having to bother with flushing expired sessions or having to wipe out all my users' sessions because memcached needed a restart is nice.