I\'ve seen this advice...
ideally the web should follow the REST principle and be completely stateless. Therefore a single URL should identify a singl
A cookie would seem to be the answer to your question. You can use the the .net authentication provider which will set a cookie, that your application can check for and require the presence for if they're to buy anything.
The thing you want to try and avoid is keeping a state representation of them on the server, aka session cookie. That will make scaling more difficult.