In a servlet container you obtain an object of the type implementing HttpSession. The very type can implement Serializable or not, depending on the implementation, the API does not mandate this.
As if I had seen somewhere a hint that you should only put Serializable stuff into the session, that is, that very container appears to use serialization to distribute the session information in a cluster.
What do you need?