Question

In ASP.NET you can set the session timeout in several places:

web.config:

<authentication mode="Forms">
    <forms loginUrl="Login" defaultUrl="Index" timeout="480"/>
</authentication>

<sessionState timeout="480"  />

And in IIS.

When is which session timeout used?

Answer 1

 <forms loginUrl="Login" defaultUrl="Index" timeout="480"/>

• is the timeout for the authentication cookie, this means that after login you have 480 minutes till you get redirected to the login page again (if you use sliding expiration it changes a bit).

<sessionState timeout="480" />

• is the timeout for the Session object, so if you have something stored into Session[“object”], this will become unavailable after 480 minutes of inactivity.
• if the session timeout is smaller than the login timeout, you could get a NullReferenceException when accessing Session[“object”].