public void validate() throws InvalidSessionException {
        //check for stopped:
        if (isStopped()) {
            //timestamp is set, so the session is considered stopped:
            String msg = "Session with id [" + getId() + "] has been "
                    + "explicitly stopped.  No further interaction under this session is "
                    + "allowed.";
            throw new StoppedSessionException(msg);
        }

        //check for expiration
        if (isTimedOut()) {
            expire();

            //throw an exception explaining details of why it expired:
            Date lastAccessTime = getLastAccessTime();
            long timeout = getTimeout();

            Serializable sessionId = getId();

            DateFormat df = DateFormat.getInstance();
            String msg = "Session with id [" + sessionId + "] has expired. "
                    + "Last access time: " + df.format(lastAccessTime)
                    + ".  Current time: " + df.format(new Date())
                    + ".  Session timeout is set to " + timeout / MILLIS_PER_SECOND + " seconds ("
                    + timeout / MILLIS_PER_MINUTE + " minutes)";
            if (LOGGER.isTraceEnabled()) {
                LOGGER.trace(msg);
            }
            throw new ExpiredSessionException(msg);
        }
    }
Determines if this session is expired.

@return true if the specified session has expired, false otherwise.
core/src/main/java/org/apache/shiro/session/mgt/SimpleSession.java