How would you do it nowadays? I still write a lot of small scripts and rarely have more state to maintain for a user session than conveniently fits in PHP's session mechanism. It's usually $_SESSION['loggedin']=bool, ['userid']=x, and perhaps a few convenience fields that are shown on every page to avoid unnecessary database roundtrips like name and anti-csrf token.
It's file-based so it probably doesn't work on multiple servers (I think you can also configure it to be database-backed, but from what I remember that's nearly as much work as just writing a proper solution yourself if you need that sort of scale), but until your software doesn't fit on a single, medium-beefy server anymore, is there an issue with this session global?
(Assuming you don't have a runaway dev that thinks they need to replicate every vaguely user-related field into the session or something. I never saw that, but with php being a common beginner's language, I could see how some people here might have run into that or have a similar argument. I think you'd have issues with such a guy/gal no matter what.)