Assuming you don't depend on deserialization and/or base64 decoding for verifying integrity (see my other comment below), then maybe you could defer deserialization until after you have verified expiry.  You don't need the deserialized object to verify integrity of the message, so you might as well check expiry first and "fail fast" if the received cookie has expired.