code: protected static void removeSessionAttributes(String[] prefixes, HttpServletRequest req) {
  
          HttpSession session = req.getSession(true);
          @SuppressWarnings("unchecked")
          Enumeration<String> en = session.getAttributeNames();
          while (en.hasMoreElements()) {
              String attrKey = en.nextElement();
              for (int i = 0; i < prefixes.length; i++) {
                  if (attrKey.startsWith(prefixes[i])) {
                      session.removeAttribute(attrKey);
                  }
              }
          }
      }
docs: Removes all session attributes starting with the given prefixes.<p>
  
  @param prefixes the prefixes of the session attributes to remove
  @param req the current request