In my ASP.NET MVC5 website the login and session timeout in web.config are as follows:
It was an issue with the SystemIdleTime variable in the IIS. I requested my hosting provider to increase this value to 30 minutes and it worked.
It indicates that all my session variables would erase as the application pool shuts down when there is no request for 30 minutes. This value would override the session's timeout set in the website's web.cofig. You could set it to 0 to indicate that the application pool will never shut down and then you could sontrol the session's timeout through web.config. I also found this good article –