@Override
      public void call(HttpServletRequest request, HttpServletResponse response) {
        if (called) {
          request.getSession().setAttribute("foo", null);
        } else {
          request.getSession().setAttribute("foo", "bar");
          called = true;
        }
      }
Setting a session attribute to null should remove it
extensions/geode-modules-session/src/integrationTest/java/org/apache/geode/modules/session/internal/filter/CommonTests.java