The timeout property of the forms authentication settings in web.config. See http://msdn.microsoft.com/en-us/library/aa480476.aspx for more information.
in my web.config i have configured 43200 min delay in form authentication + slidingExpiration option set true <forms name="NOPCOMMERCE.AUTH" loginUrl="~/Login.aspx" protection="All" timeout="43200" path="/" requireSSL="false" slidingExpiration="true" defaultUrl="~/default.aspx" enableCrossAppRedirects="false"/>
also in session configuration timeout option set for 20 min <sessionState timeout="20" mode="InProc" cookieless="false"/>
but, I have no idias why my session time live is only about 4-5 minutes, more over simetimes it less than 4 min.