title: ASP.NET session logout scenario
body: <p>I'm working on a web-based automation app (ASP.NET, VS2010,C#), users log in, do their tasks and then log out, today I was demonstrating my project, I had performed login with a username/password, then I had to describe some functionalities, so site was left on its own for more than 20 minutes (default timeout of sessions, when a users logins, I create a session for him, then check for existence of his sessions whenever a new page is going to be opened), after around 30 minutes I tried to open a new page in site, and as expected after clicking on the link, my site logout and the default.aspx page was displayed (it is the desired process). My clients asked about the reason and I told them: nothing! the sessions were timeout, I think they understood me</p>
  
  <p>is there anything wrong in this scenario? should I increase session timeout? sometimes my users may need to stay in site for more than some hours, would it be a security risk to increase the session timeout? how can I perform the whole operation better?</p>
  
  <p>thanks</p>