Usually the timeout is after 20 minutes of inactivity so that the session times out automatically after there was no interaction whatsoever of the user with the website for that time interval (AJAX calls in the background do count as activity in this sense). You can configure this timeout on your server:
sessionState Element (ASP.NET Settings Schema)[
^].
The timeout can not be greater than 525,600 minutes which is around a year or so.
[Edit]
You should also consider using a SQL Server based
StateServer[
^] as the session-state mode. The worker processes are recycled from time to time and if you don't persist your session states the session's state information will be lost. So beware, you have been warned! :) If you want to now how to control the recycling of the worker processes, please
read here for IIS 7.0[
^] and
read here for IIS 6.0[
^].
[/Edit]
Regards,
Manfred