I\'m using the AcceptVerbs
method detailed in Scott Gu\'s Preview 5 blog post for dealing with form entries in ASP.NET MVC:
It's like using ViewData, meaning it's probably not a security risk. But i would rather use ViewData than TempData. Check here for a comparason: http://www.squaredroot.com/2007/12/20/mvc-viewdata-vs-tempdata/
Depending on the design, you could always store the user / basket or whathever you need in the tempdata in the database and just have a "IsReady" field which indicates if its completed or not, making it extensable for later if you want to take in mind, that people can close their browsers.
Check out sessionless controllers in MVC3. It turned out, that using session prevents parallel execution of a single user's requests and thus leads to degraded performance.
Since tempdata uses session by default you wouldn't be able to use this feature. You can switch to using cookies for tempdata, but it's a bit awkward (at least for me). Still cleaner than viewstate, though, so maybe it's not such a big dealbreaker.