When a web session attribute implements HttpSessionActivationListener, @PrePassivate needs to be invoked prior to serialization of the session attribute for replication (and @PostActivate needs to be invoked post-serialization in order to the state of the session attribute). When using ATTRIBUTE granularity, and the backing cache is not transactional, intra-request calls to setAttribute(...) can trigger serialization of the session attribute, but are missing these callbacks.