If you are using session vars in your asp code, is it required that the user have Cookies enabled on the browser? In other words, does IIS use cookies to track the session vars between requests (since we are talking about a stateless connection)?? Or does IIS use some kind of internal tracking of the session based on the info in the headers??