Keep user-speciefic data in memory using Web API

Question

We're developing REST API using Web API for a mobile client. There is a special need to keep user specific data on server side (expensive DAL requests).

What is the best practice to do that?

• The naive way is to keep the data in the Application's memory.
• Considering security issues, we're thinking of using ASP.NET Session.

What would you recommend?
3rd party cloud solution is not an option.

Thanks!