Using the session state is a great resource, there are many forums with threads talking about the best way to use session. Some others believe to never use session. I personally like to take advantage as is there and I can keep secure information of the user. Of course it could be a very expensive resource to use if you do not manage and check it. I like to create myself a little webform to be able to see my session. Other people will use Trace instead of Response.Write so they don't have to press Control N to inherit the session to see the output.

Get the memory of the Session per user by using serialization, not just will give you the size of the object stored into session state, will also let you know if you can move the session to state server or SQL server. As if the object inside Session cannot be serialize, you won't be able to move the session state outside the InProc. Check the ArrayList with the objects that cannot be serialize in it.

Another thing I like to check if for null sessions objects, as if people destroy sessions state using:

Session[Key] = null;

They are storing a null into that session variable, if the session needs to be deleted, the best way is by doing:

Session.Remove(Key); 

public partial class DebugSession : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        int iNull = 0;
        double dTotal = 0;
        ArrayList myarray = new ArrayList();
        for (int i = 0; i < Session.Count; i++)
        {
            object ob = Session[i];

            if (ob == null)
            {
                iNull++;
                Response.Write(" NULL ");
            }

            else
            {

               Response.Write("Key=" + Session.Keys[i] + ": ");
                MemoryStream m;
                m = BinarySerialize(ob, myarray);

                //Size value
                double size = Convert.ToDouble(m.Length);
                dTotal += size;
                if ( size > 100000)
                    Response.Write("<B> Size: " + size + "</b>");
                else
                    Response.Write(" Size: " + size);

                Response.Write(" Type: " + ob.GetType().ToString());
            }

            Response.Write(" Session position: " + i);           
            Response.Write("<BR>");
        }

        Response.Write("<BR><BR>Total Count: " + Session.Count + " memory: " + dTotal);
    }

    static MemoryStream BinarySerialize(object objectToSerialize, ArrayList myarray)
    {
        MemoryStream m = new MemoryStream();
        BinaryFormatter b = new BinaryFormatter();

        try { b.Serialize(m, objectToSerialize); }
        catch
        {
            myarray.Add(objectToSerialize.GetType());
        }

        return m;
    }
}

 Hope this way, you can clean up your sessions. Some memory leaks can occur if you don't keep your sessions in check.

Cheers

Al