Web pages are, by nature, state-less objects. When you click from page to page in an ASP.net application, each request for a page is treated as a brand-new request. We use things like cookies, session-variables, and query strings to maintain state from page to page.
When you log in to an ASP.net web application using Windows Authentication, how does IIS persist your identity between pages?
Session is identified usually by a cookie (the ‘session cookie’) unless you set your app to be “cookieless”, in which case the identifier is in the url.
http://msdn.microsoft.com/en-us/library/aa479314.aspx