Well, I'm not certain you can pass the object, persay, but passing parameters or references of the object is possible. So, really it's just as if you are passing regular data however you want...
Sessions obviously are the most secure, but you can, of course as you know, use cookies, and get and post data.