protected void validate(Session session, SessionKey key) throws InvalidSessionException {
        try {
            doValidate(session);
        } catch (ExpiredSessionException ese) {
            try {
                onExpiration(session, ese, key);
            } catch (IllegalStateException eise) {
                LOGGER.trace("Attempting to validate an expired session with key {}", key, eise);
            }
            throw ese;
        } catch (InvalidSessionException ise) {
            try {
                onInvalidation(session, ise, key);
            } catch (IllegalStateException eise) {
                LOGGER.trace("Attempting to validate session with key {}", key, eise);
            }
            throw ise;
        }
    }
Looks up a session from the underlying data store based on the specified session key.

@param key the session key to use to look up the target session.
@return the session identified by {@code sessionId}.
@throws UnknownSessionException if there is no session identified by {@code sessionId}.
core/src/main/java/org/apache/shiro/session/mgt/AbstractValidatingSessionManager.java