I am in the process of making a website that involves a shopping cart. There are two major requirements:
The user experience guys want login/authentication
With those specs I would go with a database based session state. But you should do some heavy reading on how session state is handled in your web server of choice. Since you want to be able to revive the state to the correct person.