I built mine from scratch, and it's not architecturally complicated. For the user login/password, I have a small Storable file that keeps the login/passwd data. I have a simple login page that, upon submit, checks against the fields of the form. If login params match an entry, I create a session-data cookie and place it on the browser. I then create a filename (again, a Storable that holds a hash of the user's ID and any other data I want to hold. cgi scripts check the session-data hash object for info to see if the user is who he says he is, or other data I may log about him.

but the thing that I'm finding particularly annoying these days is the growing percentage of browsers that don't have cookies turned on. This is especially the case for IE7 with its default security setting having cookies off. (Or, so it seems.) The problem here is that it's not possible to implement shopping cart stuff or other session-tracking activities (for the user's benefit) using session data. I have to start passing data around in form post params, which means they have a single thread of actions that must be taken, or I lose track of what they have.

I get around 15-20K visitors a day to my site, and I'd say a good 30% or more don't have cookies on.