Use of session variable is a scalability killer because it consumes server resources (ie memory). Once you put an object in session, the memory required for the object stays in use until the session expires. By default this is 20 minutes after the last request. If one uses session variable at all one should be very judicious about what they use them for and why.

So for example if your site is getting trolled by a lot of bots and scripts they generate requests and they don't accept a session cookie so every request is a new session. So by a lot of requests it can use up all the available memory causing a denial of service for real users.

I recommend avoid use of session variables as much as possible. Only in rare cases can it be justified in my opinion. Most things can be done easy enough without them.

Best,

Joe