When you specify
sessiontimeout="#CreateTimeSpan(20,0,0,0)#" you imply that,
when a visitor opens a page on your site and goes away, he may
resume the session when he returns 20 days later. Is that what your
intention is?
The attributes, applicationtimeout and sessiontimeout, are
not specifications to determine how long application and session
vars will live. They are, respectively, the time after which
Coldfusion will time the application or session out, if it has been
inactive. That is why the default sessiontimeout value is usually
20 minutes and the default applicationtimeout 2 days. With
sessiontimeout="#CreateTimeSpan(0,0,30,0)#", the user's
session can last for 20 days, or 20 months or 20 years for that
matter, so long as there is never a gap of more than 30 minutes
when he doesn't interact with the application.
The
maximum values of applicationtimeout and sessiontimeout that
are allowed in cfapplication tags are set in the Coldfusion
Administrator. The default is 2 days(for applicationtimeout as well
as for sessiontimeout). If the value you set in cfapplication is
higher, you will not get an error. Coldfusion will just use the
Administrator's maximum value. That is likely why your sessions
held for 2 days rather than 20 days.