So we need to maintain who the user is once they have authenticated themselves. This has several drawbacks, but I will get to them a little later. The next obvious place is in a hidden field. But hidden fields are really not hidden. This token is stored in a cookie when we generate the first page after authentication.
Cookies have several limitations.
The maximum number of cookies is three hundred, with a maximum size of 4K per cookie. The 4K includes both the cookies name and its value. Another method of maintaining state information is to use a hidden frame 1 pixel wide and store data on that frame using javascript variables. Return to the top of this page. This statement tells Netscape browser to not store this page in its disk-cache.