public Session resolveSession() {
        Session session = getSession();
        if (session == null) {
            //try the Subject if it exists:
            Subject existingSubject = getSubject();
            if (existingSubject != null) {
                session = existingSubject.getSession(false);
            }
        }
        return session;
    }
The session key that is used to store whether or not the user is authenticated.
core/src/main/java/org/apache/shiro/subject/support/DefaultSubjectContext.java