Dino Esposito has a whitepaper on the risks and benefits of cookieless ASP.NET sessions.