1. HttpSession is the object representing a session in all Java web applications; @SessionAttribute is just a Spring mechanism built on top of HttpSession mainly for convenience purpose.

You can associate any objects with HttpSession using setAttribute() and remove them using removeAttribute(). You can terminate a session by calling invalidate().

@SessionAttribute are only intended to be used for model attributes (i.e. objects bound to forms) during form processing. After the form submission is processed, you call sessionStatus.setComplete() to remove these model attributes, which is more convenient than calling httpSession.removeAttribute() to remove them one by one. Note that sessionStatus.setComplete() only remove the model attributes declared in @SessionAttribute - it does not invalidate the session, and it won't remove any other session attributes.

2. If you want to keep a game object in session, use HttpSession instead of @SessionAttribute as I explained in 1.