Hi,
The session ID itself can be linked to visitor information, like IP... So the shopping cart could verify that the stored IP linked to the session matches the actual IP of the visitor. Just a thought.
Greetz
Beatnik
... Quidquid perl dictum sit, altum viditur.