Technically, ASP.NET never supported this either. It was a fluke that just happened to work when using InProc (i.e. in memory) sessions, due to the way session storage worked in that case. If you used an alternate session store like SQL Server, you would also have to serialize/deserialize objects in and out of the session. ASP.NET Core differs only in that uses a generalized session store, so it forces any object to be serialized/deserialized, even if you're using an in-memory store.
That said, your issue here is that you're simply not persisting your changes back. Again, you were relying on accidental behavior. Because ASP.NET was directly persisting the object in memory, performing operations on that object automatically "persisted" because it was the same reference. When deserializing, you are creating a new instance, so operations will not persist unless you serialize the object back into the session afterwards.
Finally, Web Forms or no, this was never a recommended or even correct way to do things. Session storage is volatile. It's not intended for anything other than short-term (and unreliable) persistence. In other words, you can never count on something being in the session, so you should always defensively code around the case where the data does not exist. If you're depending on something being there, as it sounds like is the case here, then you were always setting yourself up for failure.
However, if you're doing something like a multi-step form, it's acceptable for the individual steps to go into the session, though you should actually be using TempData
rather than Session
for that. At the last step, though, your composed object should be persisted in something like SQL Server, not the session. In virtually all other cases, you should simply persist in something like SQL Server, and avoid Session
entirely.
MemoryCache
somewhere. Then use keySessionId
and valueDictionary<string, object>
as storage for session entries.