I have a VB.ASP.NET web application which uses Form Authentication to control Security.  The setting in my web.config file is as follows:

 

<authentication mode="Forms">

<forms timeout="1480"/>

</authentication>

 

Whilst this may seem extreme I want the authentication to last for 24 hours.  When I run the code on my pc (localhost), where it has been developed it works fine and does not expire.  However when I place it on a server it defaults to 20 minutes.  Are there any IIS settings which might surpass the web.config settings

Not sure if IIS is over-riding web config, but it wouldn't hurt to change the forms timeout for your website in IIS to 1480 as well.  Just open up IIS and then open up the properties dialog for the website you want to make the change for.  Then click on Edit Configuration under the Asp.net tab and change the Forms timeout.

There's a setting under the Directory tab called Configuration; under this is a tab called App Options which has a session timeout variable. You'll want to change that.

All of this is reachable under Administrative Tools/IIS Manager, then go to your app and right-mouse click for the Properties tab(s).

Keep in mind any page that maybe set to be sessionless - not that you have done this, but I'll mention it anyway.

Many thanks,  I wasn't aware of that option but it has saved the day.