A reminder to myself and others, when you want to get access to your Session State from an ASHX or HttpHandler, you need to implement IReadOnlySessionState:

<% @ webhandler language="C#" class="DownloadHandler" %>

using System;
using System.Web;
using System.Web.SessionState;

public class DownloadHandler : IHttpHandler, IReadOnlySessionState
{
   public bool IsReusable { get { return true; } }
  
   public void ProcessRequest(HttpContext ctx)
   {
       ctx.Response.Write(ctx.Session["fred"]);
   }
}