title: Why is Session State timeout overriding Forms Authentication timeout in my MVC3 application?
body: <p>I have the following in my web.config</p>
  
  <pre><code>&lt;sessionState mode="InProc"
                timeout="2"
                cookieless="UseCookies"/&gt;
  &lt;authentication mode="Forms"&gt;
    &lt;forms
      loginUrl="~/Account/LogOn"
      timeout="1"
      cookieless="UseCookies" /&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>As far as I understand in MVC3 (or in Asp.Net) sessionState controls when the user's session on the server times out 
  and the forms authentication timeout controls when the user will be forced to log in to the website again.</p>
  
  <p>This doesn't seem to be exactly true: If I remove the sessionState section from my web.config the timeout in the authentication section is 
  completely ignored - it seems to just timeout after some default length of time.</p>
  
  <p>In fact the session state timeout seems to be required to control when authentication times out. This doesn't make any sense at all. 
  Can anyone tell me what I am missing here?</p>
  
  <p>This is related to <a href="https://stackoverflow.com/questions/8989749/timeout-not-working-in-asp-net-mvc-formsauthentication">this question</a> that I asked, but I didn't get to the bottom of why this is the case.</p>