The POD for CGI::Session has a good discussion of the various methods: cookies, query string, or hidden field. And of course, using the module will make your life easier at least as far as getting up and running with sessions.