How to Set Session Timeout and Session Idle Timeout in Asp. Net

If I have understood the question correctly (see comments by OP) then the problem is that OP wants both slidingExpiration and absoluteExpiration to be active, but with separate timeouts.

This would enable the system require a user to log back in after a certain time of idling, and to require a user to log back in after a different time even if the user was not idling.

Unfortunately this is not supported out of the box using forms authentication. You have to choose either sliding or absolute expiration. Or you have to build a workaround yourself.

You can use a very simple work around by:

• Setting the timeout of the session longer than the corresponding forms authentication timeout, and also longer than the desired absolute timeout:

  <sessionState timeout="35" mode="InProc"/>
  

• Set forms authentication to use slidingExpiration = true

• Create a user logged in timestamp in the session whenever a user logs in:

  Session["userLoggedInAt"] = DateTime.UtcNow;
  

• Add an Application_PostAcquireRequestState method to Global.asax:

  void Application_PostAcquireRequestState(object sender, EventArgs e)
  {
      HttpContext context = ((HttpApplication)sender).Context;
      if (context.Session != null && context.User.Identity.IsAuthenticated)
      {
          bool forceLogout = false;
          if (context.Session["userLoggedInAt"] == null)
              forceLogout = true;
          else if (!(context.Session["userLoggedInAt"] is DateTime))
              forceLogout = true;
          else if (DateTime.UtcNow > ((DateTime)context.Session["userLoggedInAt"]).AddMinutes(30))
              forceLogout = true;
  
          if (forceLogout)
          {
              FormsAuthentication.SignOut();
              FormsAuthentication.RedirectToLoginPage();
          }
      }
  }
  

Disclaimer: Code above was hacked together quickly, may not be fool proof...

Notes:

• Setting sliding expiration to timeout after 1 minute seems excessively paranoid. Even a fast user will not be able to finish any significant work in the application during that time. Even my web bank has a longer idle timeout that that. I would recommend a minimum of 5-10 minutes.
• Sliding expiration in forms authentication has an interesting feature: The sliding happens by updating the authentication cookie, moving the expiration date forward when the user is active. But this only happens when at least half the expiration time has passed. If you want to guarantee that a user can be idle for 10 minutes without getting logged out, you must therefore set the timeout to be 20 minutes.