This post reminds me of a problem I am currently experiencing. . . If the state of the data is stored in a database, for example, and we pass around a session ID, how do we keep our database from becoming cluttered? How and when do we clean up the data left behind by no-longer used sessions? I imagine schedule a task to delete unused sessions, but by what criteria? Do we update the session timestamp every time a user performs and action, and delete only those sessions that haven't been touched in, for example, 30 minutes?