Yes, the session would be an appropriate place for that information. Assuming you are using the authentication features baked into the ASP.NET framework, you will either be loading the user ID from HttpContext.Current.User.Identity.Name or looking it up from that value.