Reading Guru-Gu's blog post about ASP.NET MVC3 hitting RC, he says:-
Session-less Controller Support
You can now indicate whether you want a Controller class to use session-state – and if so whether you want it to be read/write or readonly.read/write or readonly.
Can someone explain what are some scenario's someone might want to have a session-less controller? or a read-only controller?
I've always been creating a separate IIS website which I use to handle all static images/content and then have this same website have session state turned off ... so no cookies are sent over the wire. Is this a similar scenario?
Gu commented about this. Quoting:
The release notes cover this more (you can download them from the download link above). Session state is designed so that only one request from a particular user/session occurs at a time. So if you have a page that has multiple AJAX callbacks happening at once they will be processed in serial fashion on the server. Going session-less means that they would execute in parallel.
This is a known scenario in ASP.NET in general. The session object for the same user is not thread safe. This means that if the same user (same session id cookie) sends multiple requests to a page which uses session those requests will queue and will be processed in series and not in parallel.
来源：https://stackoverflow.com/questions/4139428/what-are-some-scenarios-of-having-a-session-less-controller-in-asp-net-mvc3