Your approach of using the System.Web.HttpContext.Current.Session is correct, or as correct as it gets.
DotVVM does not reference System.Web, it relies on the Owin interface which doesn’t provide access to session (AFAIK). This means there isn’t a way for us to provide any universal abstraction over Asp.Net and Asp.Net Core sessions.
Also note that HttpContext.Current is sensitive to Async methods, so it might be a good idea to store it somewhere (i.e. variable, scoped service) before doing async calls. It would be null, so you’ll notice if run into this issue.