Did you know that this is exactly what the Apache::Session module does? All you have to do is store the key on the client side. Don't be put off by the name: it has nothing to do with Apache or mod_perl.

To your specific questions, this is a good way to do it but don't put much data in the serialized object or it will start to get slow. You should only put things like keys into other tables in there (shopping cart ID, user ID). You don't need to get Storable to read from the database. You just give it a scalar containing serialized data that you fetched from the database. Storable is available from ActiveState's PPM system and I think they ship it with their distribution. There are other pre-built Perl distros for Win32 that have it, like the one Randy Kobes builds. Storable will be part of the standard library starting in perl 5.8.