code: public static <T> AttributeKey<T> sessionScoped() {
          return new AttributeKey<T>() {
              public T get(HttpServletRequest req) {
                  HttpSession s = req.getSession(false);
                  if (s==null)    return null;
                  return (T)s.getAttribute(name);
              }
  
              public void set(HttpServletRequest req, T value) {
                  req.getSession().setAttribute(name, value);
              }
  
              public void remove(HttpServletRequest req) {
                  HttpSession s = req.getSession(false);
                  if (s!=null)
                      s.removeAttribute(name);
              }
          };
      }
docs: Creates a new session-scoped {@link AttributeKey}.