Best practices for using HTTP sessions(Java)

My personal approach would be not to use the session everywhere. I'd try to reduce its usage at the controller layer. In the controller I'd extract what I will need to call my logic and the logic that I use will not directly know that there is a web session involved. This will make that logic portable to non-web application, and will have all its data in a type-safe manner that is free of boilerplate code.

If you want to avoid the boilerplate code of obtaining the request, then the session, and then the items from the session, your method approach is fine enough, and a common practice in my experience. If you are using it in Java, you can improve it a little by adding some generics:

 private <T> T getSessionValue(final String key) {
    ServletRequestAttributes reqAttr = (ServletRequestAttributes) RequestContextHolder
                        .currentRequestAttributes();
        return (T) reqAttr.getRequest().getAttribute(key);
}

You can use it now like this:

Integer someSessionInt = SessionUtils.<Integer>getSessionValue("someSessionIntKey");

I am assuming the method is defined in a SessionUtils class. If you define it in a base controller class and use inside a controller, you should call it like this instead:

Integer someSessionInt = this.<Integer>getSessionValue("someSessionIntKey");

The this can be substituted with super. Without it a compile error may occur due to the generics.

In addition to my suggestion above, there is another way of hiding the session direct usage and have a session-free and independent API/facade. By sticking to the programming-to-interfaces paradigm you can have interface implementations that use the session, but it is never shown by the interfaces you enforce in your facade/api. So, for instance you may have a general purpose authorization service, exposed trough interface, that shows you who is the currently logged user, ifs/he is a guest and whether s/he has a permission. Your application then could use a concrete implementation of the service interface that gets the user from the session. When you use the service, the interface does not expose anything related to the session, so it is hidden to it.