You usually don't store the *actual* data on the client cookie, but you store a session cookie that will point to some place on disk where you keep the session data stored. A number of utilities around help automating this. If you cannot store a cookie on the client, you usually add the session information in a hidden variable, more or less like PHP does with PHPSESSIONID.....

This is the general idea. Then, as you say, the devil is in the details. :-)