you can do using Web.Config file. there are three type of Session as below, you have to add below section into web.config
1)InProc
<sessionstate mode="InProc" cookieless="true" timeout="30" />
2)StateServer
<sessionstate mode="StateServer" stateconnectionstring="tcpip=SampleStateServer:42424" cookieless="false" timeout="30" />
3)SQLServer
<sessionstate mode="SQLServer" sqlconnectionstring="Integrated Security=SSPI;data source=SampleSqlServer;" />
session will expire automatically when user is idle for 30 min