ASP.NET Core: 'Session has not been configured for this application or request'

InvalidOperationException: Session has not been configured for this application or request. means your code read HttpContext.Session on a request that the session middleware never touched. In the test the services were registered and only app.UseSession() was missing; adding that one line fixed it.

Put app.UseSession() after builder.Build() and before the endpoints that use the session, and keep AddDistributedMemoryCache() and AddSession() on the services.

The error

fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HNPRRAJ9TAGP", Request id "0HNPRRAJ9TAGP:00000001": An unhandled exception was thrown by the application.
      System.InvalidOperationException: Session has not been configured for this application or request.
         at Microsoft.AspNetCore.Http.DefaultHttpContext.get_Session()
         at Program.<>c.<<Main>$>b__0_11(HttpContext ctx) in C:\...\FixLab\Program.cs:line 61
...

The client got HTTP/1.1 500 Internal Server Error with Content-Length: 0.

Why it happens

The broken program registered the session services but did not add the middleware:

builder.Services.AddDistributedMemoryCache(); builder.Services.AddSession();
var app = builder.Build();
...
app.MapGet("/cart", (HttpContext ctx) =>
{
    var count = (ctx.Session.GetInt32("items") ?? 0) + 1;
    ctx.Session.SetInt32("items", count);
    return $"items in cart: {count}";
});

The stack trace shows the exception raised by the Session property getter (DefaultHttpContext.get_Session()), called from the handler at line 61. So the failure is in reading the property, before any value is read or written. Registering AddSession() was not enough on its own: the app started normally and the exception came only when the /cart request arrived.

To find the culprit in a bigger project, read the frame just under get_Session(): here it names Program.cs:line 61, the line of the handler that first touches ctx.Session. The frames below it list the middleware the request passed through on its way in. In this log that was HostFilteringMiddleware and nothing related to session, which matches the missing UseSession() call.

The fix

builder.Services.AddDistributedMemoryCache(); builder.Services.AddSession();
var app = builder.Build();
app.UseSession();
...

With that line, two calls that share a cookie jar showed the session working (the cookie value is shortened to CfDJ8... below):

curl.exe -s -D - -c jar.txt -b jar.txt http://127.0.0.1:15711/cart
HTTP/1.1 200 OK
...
Set-Cookie: .AspNetCore.Session=CfDJ8...; path=/; samesite=lax; httponly
Transfer-Encoding: chunked

items in cart: 1
curl.exe -s -D - -c jar.txt -b jar.txt http://127.0.0.1:15711/cart
HTTP/1.1 200 OK
...
items in cart: 2

The first response set the .AspNetCore.Session cookie and the second request, which sent it back from jar.txt, read the stored count and answered items in cart: 2. The first response also carried Cache-Control: no-cache,no-store next to the cookie (cut from the block above); the second response had neither header. The endpoint code was the same in both programs; the only change was the middleware line.

How it was reproduced

A dotnet new web project (net10.0) with the /cart endpoint above, run in the Production environment on port 15710 (broken) and 15711 (fixed), called with curl 8.21.0. .NET SDK 10.0.403, Microsoft.AspNetCore.App 10.0.14, Windows 11; the session types ship with the shared framework, so no package was added.

Frequently asked

Why does HttpContext.Session throw 'Session has not been configured'?

In the test, AddSession() was registered but app.UseSession() was missing, so reading the Session property threw InvalidOperationException and the request returned 500.

Where do I put app.UseSession() in Program.cs?

After builder.Build() and before the endpoints that use the session. In the test that one line made /cart return 200.

How do I test ASP.NET Core session with curl?

Use a cookie jar: curl -c jar.txt -b jar.txt. In the test the first call set the .AspNetCore.Session cookie and the second call read the stored value back.

More decoded errors in the Fixes category.