In my current project I have written a state module that takes a hash of info, Data::Dumper's it, Crypt::TripleDES encrypts it and then mime encodes it. It also does the reverse to get the data structure back.

I then pass this back to my main app for dealing how I want. Currently I am storing an ID and a timeout. I use the ID in the program to fetch more info - much like the branding that Merlyn was talking about further up this node.

I am using the timeout as a means of providing an inactivity flag. I haven't finished implementing this yet but the idea is to allow someone to be deactivated if they walk away from their browser. I didn't want to rely on cookie timeouts as this then ties me to a single session solution.

Slightly OT but the EU almost banned cookies over here. Obviously this was never going to happen but beurocrats love to meddle :).

The kind of interface I am using for my session object is as follows:

addToSession()
getFromSession()
_buildSession()
clearSession
session()
toString() <------- called via overload
key()  <------- for the encryption (obviously :P)
[download]

I didn't use anything like Apache::Session simply because I had to ensure it would work with IPlanet, Apache and IIS for the content management system I'm building at work.

Hope that helps.