With ASP.NET WebForms it is possible to set the session state mode in the page directive:
<%@ Page EnableSessionState=\"true|false|ReadOnly\" %>
The ASP.NET MVC 3 equivalent to this appears to be the SessionState attribute, which you apply at the controller level - e.g.
[SessionState(SessionStateBehavior.ReadOnly)]
See http://msdn.microsoft.com/en-us/library/system.web.mvc.sessionstateattribute.aspx for more info.
Thanks to https://stackoverflow.com/a/4235006/372926