ASP.NET Bad Practices: Non-Serializable Object Stored in Session for String Value

Question

I work in legacy web app developed in .net 3.5,built close to 15 years ago. Recently the app code was scanned by Fortify . It listed all the code samples(close to 200) like