This article at Microsoft provides detailed analysis of different modes that can be used to store states: http://msdn.microsoft.com/en-us/library/ms972429.aspx

In short, you can use "in-proc" for the simplest method which will store the sessions inside the memory of your application. However, app pools on our shared services (dedicated app pool for each website) are limited to a certain amount of memory.

To get around that limitation, we suggest using the "out-of-process" mode. To do this, the string will be changed to something like this in the web.config:

<configuration>
  <system.web>
  <sessionState mode="StateServer" cookieless="false" timeout="20" />
  </system.web>
</configuration>

For further explanation on what the above tags mean, please refer to the Microsoft post at the start of this post.

This may be necessary for this to work properly: http://aspnetresources.com/tools/machineKey

The machineKey tag would be placed inside your web.config .