We figured out how to enable session state with webapi Sample here
Now we have WebApi 2 attribute routing, so we no longer have route object to inject custom handler
in the global.asax
Private Sub WebApiApplication_PostAuthorizeRequest(sender As Object, e As EventArgs) Handles Me.PostAuthorizeRequest System.Web.HttpContext.Current.SetSessionStateBehavior(System.Web.SessionState.SessionStateBehavior.Required) End Sub