HTTP state management without cookies?

[Paul Rubin]

philh at comuno.freeserve.co.uk (phil hunt) writes:
> What do you consider the other 2 methods to be? I can think of 
> encoding it in the URL, and the server remembering the browser's IP 
> address. Are there others?

You CANNOT identify sessions by browser IP addresses.  That's been
discussed here several times.  Think of proxy servers sending requests
from many browsers through the same IP address--for example, AOL
proxies millions of browsers through a few hundred addresses.

A number of other means of identifying sessions have been discussed
here in the past few weeks though.