custom session management and authentication

Hi All, I have noticed a couple threads on this list about sessions lately and I was curious how many people roll their own session management? If you do, how do you do it? To get the ball rolling, this is what I do. I use an associative array to hold session data ($session['foo']). New variables are easily introduced to a session with array manipulation. The array is serialized and stored in a database when the session needs to be saved along with some other data. It is then pulled from the db when needed. The key is a unique ID that I generate when a session is created. The session can be killed by deleting it from the database, or removing the authentication cookie. I rely on cookies to hold a client authentication token. This is compared to a token generated on the server for authentication. Very similar to the method discussed in this article: http://www.usenix.org/events/sec01/fu/fu_html/index.html I imagine it could be implemented using a URL variable as well. I have not tried it. I like to use a cookie. My feeling is that if Yahoo requires them, it is probably ok. Anyway, would like to hear what others are doing as well as opinions on what I am doing. Brad