Hello!  We're working on using AJAX with a particular module.  It has come to our attention to write the back end service(s) using the DnnApiController service infrastructure. (Using DNN 7.x)

    [SupportedModules("ModuleXYZ")]
    public class ModuleXYZAJAXViewController : DnnApiController
    {
        [AllowAnonymous]
        [HttpGet]
        public HttpResponseMessage GetData()
        {
            string output = HttpContext.Current.Session["example"]; //ALWAYS IS NULL within this SCOPE/CONTEXT

            return Request.CreateResponse(HttpStatusCode.OK, output);
        }
    }

This back end code when called, works as predicated.  What fails is that within this scope the session reference is always null.  The session reference is not null anywhere else in any of the .ascx files.  Because of this issue, I have adjusted the routing to add in the session context to the request as well, alas this is not working.

 I have included my routing code as well on how I was attempting to extend the session layer into the WebAPI.

public class ModuleXYZViewService : IServiceRouteMapper
{
    public void RegisterRoutes(IMapRoute mapRouteManager)
    {
        var route = mapRouteManager.MapHttpRoute("ModuleXYZ", "default", "{controller}/{action}",
            new[] { "ModuleXYZ.Ajax" });
        foreach (Route r in route)
        {
            r.RouteHandler = new SessionBasedControllerRouteHandler();
        }
    }
    public class SessionBasedControllerHandler : HttpControllerHandler, IRequiresSessionState
    {
        public SessionBasedControllerHandler(RouteData routeData) : base(routeData)
        {
        }
    }
    public class SessionBasedControllerRouteHandler : HttpControllerRouteHandler
    {
        protected override IHttpHandler GetHttpHandler(RequestContext requestContext)
        {
            return new SessionBasedControllerHandler(requestContext.RouteData);
        }
    }
}

Believe you-me, I don't like trying to extend the session tier into a web method.  But given the case of making a flexible AJAX service and keeping it secure, the session tier needs to be still in tact.  The only other solution would be encrypting my payload during page load and passing it into the AJAX call in hopes that someone on the outside wouldn't figure out.  Any thoughts or ideas on a solution of extending the session layer such that it is not null in the scope and context of the Web API?  This is a known design limitation with the core ApiController of .Net.  I look at it as not a bug, but a proper way of doing web APIs.