Use timeout in web.config, can also use timespan--20 minutes is default, also The timeout attribute cannot be set to a value that is greater than 525,601 minutes (1 year) for the in-process and state-server modes.

<sessionstate>
    mode="[Off|InProc|StateServer|SQLServer|Custom]"
    timeout="number of minutes"............

   ....../></sessionstate>

msdn

解决过期的ASP.NET会话状态和选项