title: Session Timeout not working ASP.NET 4
body: <p>We are having difficulty getting the Session Timeout to work in ASP.NET 4.  We have the timeout set for 720 minutes(12 hours).  We are using Forms Authentication.  The timeout occurs after about 20 minutes regardless of what I set the timeout to.  I'm sure we configured something wrong, but I'm not sure what.  I've looked online at several fixes(headers, etc), but can't seem to get anything to work.  Here is our config file:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
       &lt;forms loginUrl="~/Login.aspx" name="CAFormsAuth" timeout="720" slidingExpiration="true" defaultUrl="Default.aspx" /&gt; &lt;/authentication&gt; &lt;authorization&gt;    &lt;!--&lt;allow users="*"/&gt;--&gt;   &lt;deny users="?" /&gt; &lt;/authorization&gt;
  </code></pre>
  
  <p>Here is our login code:</p>
  
  <pre><code>try
          {
              string adLogin = txtUserName.Text;
  
              bool isValid = false;
              //Validate User against AD First...
              //----------------------------------
              try
              {
                  isValid = AuthenticateUser(cboDomains.Text, adLogin, txtPassword.Text);
              }
              catch (Exception ex)
              {
                  //Should read "Invalid Username or Password"...
                  //lblError.Text = ex.Message;
                  lblError.Text = "Invalid User Name or Password.";
                  return;                   
              }
  
              //Now, See if the user exists in the database.
              //---------------------------------------------
              db_users user = null;
              try
              {
                  user = usrHelp.GetUserByADUserName(cboDomains.Text + @"\" + adLogin);
  
                  if (user == null)
                  {
                      lblError.Text = "User " + adLogin + " does not exist in the database.";
                      return;
                  }
              }
              catch (Exception ex)
              {
                  ErrorLoggingHelper.LogToSource(Globals.ApplicationName, ex.ToString(), System.Diagnostics.EventLogEntryType.Error);
  
                  lblError.Text = "User " + adLogin + " does not exist in the database.";
                  return;
              }
  
              if (isValid)
              {
                  if (chkRemember.Checked)
                  {
                      SetCookies();
                  }
                  else
                  {
                      RemoveCookie();
                  }
              }
              else
              {
                  lblError.Text = "Password is not valid";
                  Telerik.Web.UI.RadAjaxManager.GetCurrent(this.Page).ResponseScripts.Add(String.Format("SetFocus('{0}')", txtPassword.ClientID));
                  return;
              }
  
              Session[Globals.LoggedInUserName] = txtUserName.Text;
              Session[Globals.LoggedInUserId] = user.user_id;
              Session["CurrentUser"] = user;
  
              FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);
  
          }
          catch (Exception ex)
          {
             //deleted error logging code here...
              lblError.Text = "Error authenticating user. Please contact the administrator.";
          }
  </code></pre>