A web "session" mechanism always works the same way: a cookie and/or part of the URL string contains a randomly-generated identifier which is used as the primary key of a session-information table containing whatever data the server wishes to store. It's usually a good idea for that information to include the primary-keys of other tables, such as info about who is logged on and even ("in the bigger scheme of things") what that "person" is currently doing. There are gobs of session-handling modules in CPAN, with thorough descriptions of how they work.