We have a fairly big web based solution which runs on .Net 4.5. Recently, while we were examining a performance issue where the system seemed to be only serving one request at any given time (per client) we learned that the cause of that was the session state. By changing the EnableSessionState attribute to ReadOnly, multiple requests can be served simultaneously and performance was dramatically improved.
We thought maybe that we would run into all kinds of issues since we are relying on the session state for a number of things in our system, but so far we haven't really had any negative side effects at all. Logins work as expected and all the things we store in the session state also seem to work fine.
That begs the question ... why isn't this the default behaviour? Are there any obvious bad side effects of this that we just have not experienced yet?