By default, ASP.NET uses cookies to store the Session ID on the client's browser (the cookie is named ASP.NET_SessionId by default). While session data itself can be stored in memory, State Server, or SQL Server, the ID itself is transmitted via a cookie unless cookieless session state is explicitly enabled.