Session variables are a function of ASP.NET and not of DNN.
Session info is related to a Connection Session - that is - for each web browser connection to the server - there is a session. This bears no relation to whether a user is logged on to DNN or any other web application for that matter
As for how a session can timeout before DNN - not exactly sure what you are seeing here - if DNN appears to timeout then it is because the session has timed out - these two aspects are directly interrelated.
If you are going to use session variables that are USER specific then you need to be careful how you handle them.
I handle all my access to sesson variables thru a custom class that has two exposed methods
setSession( userid, myKey, myValue)
getSession( userid, myKey )
Both the setSession and getSession methods require a userid parameter
The methods use the userid value to control the validity of the info.
Both method read or Set a "WL_UserID" session variable that I only use inside the methods
The get method always checks the "WL_UserID" session variable and only returns a value if the userid matches the session.
This way - you dont really need to clear session variables when the user logs off - or if the timeouts get out of sync - also you can also code for for lost session / change of user info etc inside the custom class.
For example - if you do a set and the userID does not match the WL_UserID then force all your session info to reset to a default
Westa