You can use following to setup session timeout for whole application in web.config.
<sessionState mode="InProc" timeout="5"/>
This will remove session after 5 minutes of inactivity.
Session is one of the EJBs and it represents a single client inside the Application Server. Stateless session is easy to develop and its efficient. As compare to entity beans session beans require few server resources.
To get more detail about session refer following article.