What I have opted for when doing modern web development is to eschew the idea of session all together. Decoupling authorization and authentication from data sto

What I have opted for when doing modern web development is to eschew the idea of session all together. Decoupling authorization and authentication from data storage is one of the advantages while the other is that you do not run into the standard anti-patterns that session creates on the web. With AJAX style request you can exchange authentication and authorization tokens like SAML or oAuth. This can be done by adding authorization headers to the payload, and employing some form of salted encryption. Given that I am not a security expert, I tend to use patterns and encryption algorithms that the security community has endorsed. Some of the more comprehensive JavaScript frameworks like Dojo have crypto implementations. From there I tend to use a cache on the client side, to store transient data that needs to live from request to request and cannot be retained in memory for whatever reason.