protected boolean isTimedOut() {

        if (isExpired()) {
            return true;
        }

        long timeout = getTimeout();

        if (timeout >= 0L) {

            Date lastAccessTime = getLastAccessTime();

            if (lastAccessTime == null) {
                String msg = "session.lastAccessTime for session with id ["
                        + getId() + "] is null.  This value must be set at "
                        + "least once, preferably at least upon instantiation.  Please check the "
                        + getClass().getName() + " implementation and ensure "
                        + "this value will be set (perhaps in the constructor?)";
                throw new IllegalStateException(msg);
            }

            // Calculate at what time a session would have been last accessed
            // for it to be expired at this point.  In other words, subtract
            // from the current time the amount of time that a session can
            // be inactive before expiring.  If the session was last accessed
            // before this time, it is expired.
            long expireTimeMillis = System.currentTimeMillis() - timeout;
            Date expireTime = new Date(expireTimeMillis);
            return lastAccessTime.before(expireTime);
        } else {
            if (LOGGER.isTraceEnabled()) {
                LOGGER.trace("No timeout for session with id [" + getId()
                        + "].  Session is not considered expired.");
            }
        }

        return false;
    }
Determines if this session is expired.

@return true if the specified session has expired, false otherwise.
core/src/main/java/org/apache/shiro/session/mgt/SimpleSession.java