@Test
  public void testSetAttributeNullSession1() {
    // Setup
    CallbackServlet s = (CallbackServlet) getServlet();
    s.setCallback(new Callback() {
      private boolean called = false;

      @Override
      public void call(HttpServletRequest request, HttpServletResponse response) {
        if (called) {
          request.getSession().setAttribute("foo", null);
        } else {
          request.getSession().setAttribute("foo", "bar");
          called = true;
        }
      }
    });

    doFilter();
    doFilter();

    HttpSession session = ((HttpServletRequest) getFilteredRequest()).getSession();

    String attr = (String) session.getAttribute("foo");
    assertNull("Attribute should be null but is " + attr, attr);
  }
Setting a session attribute to null should remove it
extensions/geode-modules-session/src/integrationTest/java/org/apache/geode/modules/session/internal/filter/CommonTests.java