Can you add test to verify that all the types mentioned in TypeHelper.IsSimpleType can be deserialized...I am specifically interested about struct and also not sure about Uri

https://github.com/aspnet/Mvc/blob/dev/src/Microsoft.AspNet.Mvc.Common/TypeHelper.cs#L68

Formatting nit: member data needs to preceed the actual test.

Need to consult with @blowdart to use this because it is generally not allowed to use any TypeNameHandling value other than None. I don't know if we can guarantee that the data is coming from a trusted source. For example, suppose that the session state provider is a custom one that stores all session data in a cookie - that is no longer trusted data because it can be tampered. Our default session state providers can't be tampered because they are stored in trusted environments (local machine memory, Azure Cache, etc.).

Indeed. You can't ship this. Use of Auto is banned because it enables RCE. Unless you can ensure every input is signed, and validated you need to find another way to do this.

@blowdart FYI - be happy 😄

When am I ever HAPPY? I am content.

Could you create a new dictionary rather than writing to this one (preferably one with StringComparer.OrdinalIgnoreCase semantics? Seems cleaner than doing a ToList here. An additional advantage is we could change the dictionary we wrap in TempDataDictionary to be a copy-on-write one.

_dictionaryConverters

Do this early on as part of detecting the IDictionary<,>. You can avoid having Type[] actualTypes and just have one.

The '{0}' cannot serialize a dictionary with a key of type '{1}' to session state. (Swapped {0} and {1} too.)

Just split this out:

if (itemType.ExtractGenericInterface(typeof(IList<>)))
{ 
      Debug.Asser(itemType.GetGenericArguments().Length == 1, "IList<T> has one argument");
       itemType = itemType.GetGenericArguments()[0];
}
if (itemType.ExtractGenericInterface(typeof(IDictionary<>)))
{
    var genericTypeArguments = itemType.GetGenericArguments();
   Debug.Assert(genericTypeArguments.Length == 0);
   ...
}

Let's make JToken a parameter.