HttpSession is preferable because it stores session data server-side with no size limit, provides good performance, and doesn't depend on client-side settings. Cookies can be disabled by users, hidden form fields have security limitations, and URL rewriting is cumbersome and has security issues.