I have faced problem of testing Java Services that used Session Scoped objects (Same would by with f.e. Request Scope). My Scoped object was treated as a data, but contained simple operations managing its state. My service did some operation on this object changing it state. First I tried to mock this object and mocking its methods to verify correct behavior. But it was not easy due to complicated structure of mocking object. Then I decided to use a Spy object, but the only reason is to inject this object into my Service with annotation @InjectMocks. I did not change my object at all in the Spy, but used it just for dependency injection, as I did not want to have a setter method only for testing.
So the conclusion is: In Mockito Session/Request Scope Objects can be easily tested when defined as Spy objects injected by @InjectMocks