They are all slightly different things and do not necessarily need to be in sync:
<forms name=".ASPXAUTH" cookieless="UseCookies" timeout="20" />
Is a Forms Timeout and is the length in time that the auth cookie is valid. Once this time is reached, the cookie will no longer be valid and the user will no longer be authenticated.
<sessionState mode="InProc" cookieless="false" timeout="20" sessionIDManagerType="Sitecore.SessionManagement.ConditionalSessionIdManager">
Is a Session State Timeout and is the amount of time a provider is expected to hold data in memory/SQL (in-proc/sql session state). After this timeframe, the data will be removed regardless of if the user is authenticated or not. The timeout counter will be reset after each request.
<setting name="Authentication.ClientSessionTimeout" value="20" />
Is the Sitecore Authentication Timeout and is the length of time that Sitecore considers an authenticated session is valid for. This setting is only considered relevant for logins to the
The noteworthy difference between
ClientSession Timeout and the
Forms Timeout is the scope of the users.
Forms Timeout will be in effect for any and all Form authentication since it's application bound while the
ClientSessionTimeout is specific to the Sitecore Client. If your site does not contain any additional
Forms Auth than what is used for a standard Sitecore Client user, then the
Forms Timeout may match the
ClientSession Timeout, but if you are using a different provider for Sitecore Client authentication (LDAP) or have any other Forms on the site that would require different timeout windows, they can be set to different values.
Edit: After @Teeknows comment about
ClientSessionTImeout being set to 1 and the other values being set to 20 and not getting logged out, I looked a hair further. From what I can gather,
DomainAccessGuard does some checks if your session is valid within/for the domain. It looks like one of the few times the
Authentication.ClientSessionTimeout is checked is only after
DomainAccessGuard checks for an active session and doesn't find one which (I could be wrong) implies that it was invalidated and removed, or the
Sitecore.Support.SessionTimeout.ExpirationAgent disposed of it (https://kb.sitecore.net/articles/345947). This may be why setting
ClientSessionTimeout to less than
FormsTimeout may not necessarily trip a re-auth, especially if this is only being used by a single user at the time (not managing multiple sessions against a license/domain).