The backend could be anything. Really the only connection a session has is its key cookie. Like egsuh said, though, TStringList won't survive one shot execution model employed by CGIs. Unless, you (Save|Load)FromFile accordingly. I usually just use Redis for session, as it has built-in expiration mechanism fully user controllable from query.