public Object removeAttribute(Object key) throws InvalidSessionException {
        try {
            String sKey = assertString(key);
            Object removed = httpSession.getAttribute(sKey);
            httpSession.removeAttribute(sKey);
            return removed;
        } catch (Exception e) {
            throw new InvalidSessionException(e);
        }
    }
{@link Session Session} implementation that is backed entirely by a standard servlet container
{@link HttpSession HttpSession} instance.  It does not interact with any of Shiro's session-related components
{@code SessionManager}, {@code SecurityManager}, etc., and instead satisfies all method implementations by interacting
with a servlet container provided {@link HttpSession HttpSession} instance.

@since 1.0
web/src/main/java/org/apache/shiro/web/session/HttpServletSession.java