We have an ASP.Net 3.5 website running on Windows Server 2008 with IIS7. The session timeout period for this site is configured to be 20 minutes - however, it is currently lasting for between 40 and 50 seconds. After researching the problem we investigated several configuration values which could be involved in the timeout period but none of them are set to less than 20 minutes. The areas we look are as follows:

• web.config system.web/sessionState element (20 minutes).
• web.config system.web/authentication/forms element (not present, defaults to 30 minutes).
• Sites/{website}/ASP/Session Properties/Time-out (20 minutes).
• Application Pools/{appPool}/Advanced Settings/Process Model/Idle Time-out (20 minutes).

We've also noted that the CPU is staying around 0% and that RAM usage is flat-lining around 1.07 GB (of 8 GB available) - so there is no performance-based reason for IIS to be recycling the Application Pool as far as we can tell.

Are there any settings we've overlooked which could cause the session timeouts to be expiring so quickly?

EDIT

A couple of additional points:

• This is not occurring in development, only on the server.
• The session is not sliding (i.e. if we refresh the page a few times it still times out approximately 40 - 50 seconds after the session was created.