code: public void sessionWillPassivate(HttpSessionEvent event) {
          for (Entry<String, SessionFieldMapper> entry : this.entrySet())  {
              if (!entry.getValue().serializable) {
                  event.getSession().removeAttribute(entry.getKey());
              }
          }
      }
docs: Remove all non-serializable fields from session.