Forms authentication timeout vs sessionState timeout

https://stackoverflow.com/questions/17812994/forms-authentication-timeout-vs-sessionstate-timeout

They are different things. The Forms Authentication Timeout value sets the amount of time in minutes that the authentication cookie is set to be valid, meaning, that after

value

number of minutes, the cookie will expire and the user will no longer be authenticated - they will be redirected to the login page automatically-. The

slidingExpiration=true

value is basically saying that after every request made, the timer is reset and as long as the user makes a request within the timeout value, they will continue to be authenticated. If you set

slidingExpiration=false

the authentication cookie will expire after

value

number of minutes regardless of whether the user makes a request within the timeout value or not.

The

SessionState

timeout value sets the amount of time a Session State provider is required to hold data in memory (or whatever backing store is being used, SQL Server, OutOfProc, etc) for a particular session. For example, if you put an object in Session using the value in your example, this data will be removed after 30 minutes. The user may still be authenticated but the data in the Session may no longer be present. The

Session Timeout

value is always reset after every request.

<authentication mode="Forms">
<forms loginUrl="CMSPages/logon.aspx" defaultUrl="Default.aspx" name=".ASPXFORMSAUTH_cms6000" timeout="1440" slidingExpiration="true" path="/"/>
</authentication>

<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes" cookieless="false" timeout="20" />

https://stackoverflow.com/questions/1470777/forms-authentication-timeout-vs-session-timeout

To be on the safe side: TimeOut(Session) <= TimeOut(FormsAuthentication) * 2

If you want to show page other than specified in loginUrl attribute after authentication timeout you need to handle this manually as ASP.NET does not provide a way of doing it.