title: Where to set session timeout?
body: <p>The application sets session.timeout in Application_AcquireRequestState event handler.</p>
  
  <p>Before session expires, there is notification window popping up. It resets session timeout to, say, 3 minutes (normally, it is 30 minutes), through Application_AcquireRequestState.</p>
  
  <p>The notification offers user an option to extend session for another 30 minutes. If user clicks yes, it will reset session timeout for 30 minutes through the previous event handler.</p>
  
  <p>The problem is, though user clicks yes, and session timeout is set correctly, session seems timeout before the set time. This only happens after notification.</p>
  
  <p>The suspicion is when it hits Application_AcquireRequestState, the timeout is already calculated for this request. The new timeout value will be used for next request. So when user clicks yes to extend session, the timeout for current request is not 30 minutes away, it is only 3 minutes away, due to timeout set by the notification window. The yes will only be in effect if user sends another request.</p>
  
  <p>(Notification window has its own timing object)</p>
  
  <p>Can anyone verify this? or point me to a good resource to explain how asp.net manages this?</p>
  
  <p>Thanks!</p>