How do I set session timeouts in Sitecore?

Question

How do I increase session timeout for content authors? Authors complain that the default timeout is far too short.

Answer 1

There are potentially 3 places in the web.config to modify to extend session timeout:

<!--  AUTHENTICATION CLIENT SESSION TIMEOUT
    Specifies the number of minutes before Sitecore considers user authentication session tickets as expired.
    This setting is only relevant for users logging in to Sitecore Client and when the Sitecore license has a limited number
    of concurrent editors. 
    All expired sessions will automatically be removed when a new user tries to log in and the maximum
    number of concurrent editors has been reached. 
    The default is 60 minutes (1 hour).
-->
<setting name="Authentication.ClientSessionTimeout" value="180" />

And because Sitecore uses the .NET Membership Provider:

<!--  AUTHENTICATION 
      This section sets the authentication policies of the application. Possible modes are "Windows", "Forms", 
      "Passport" and "None"
-->
<authentication mode="None">
  <forms name=".ASPXAUTH" cookieless="UseCookies" timeout="180" />
</authentication>

And finally, session state (you shouldn't using out of proc for CM so it should look like this):

<!--  SESSION STATE SETTINGS
      By default ASP .NET uses cookies to identify which requests belong to a particular session. 
      If cookies are not available, a session can be tracked by adding a session identifier to the URL. 
      To disable cookies, set sessionState cookieless="true".

      Note that Sitecore does not support cookieless sessions
      <sessionState mode="StateServer" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;user id=sa;password=" cookieless="false" timeout="20"/>
-->
<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;user id=sa;password=" cookieless="false" timeout="180" />