I am building an ASP.NET web site that uses FormsAuthentication and a standard Session mechanism with configuration like:
The reason I sometimes ask myself this question, is to prevent accessing "expired" session objects. When the session expires prior to login expiration, and the user requests a page that uses data from the session, a nasty null reference exception happens.
You may find this article helpful. It discusses several solutions to detect expired sessions and inform the user about that.