Like I said, it won't be an issue if the concurrent users are low, and you clear it at first chance. But, be aware, if the user takes the steps necessary to generate this XML string, then clicks home and you empty the string, then if they click back on the browser, they are gonna have to get the xml again (meaning another call to DLL). It may be better to let them lug the thing around, and empty it only when the session ends.

Just some things to think about