Hunting asp.net Authentication and Session Ghosts

Asp.net handles the features of user authentication and user session in two different ways that sometimes may produce ghosts (bugs difficult to find) in our web applications.

The default forms authentication time is 20 mins. Session timeout is extended (to another 20 mins) for every request made to the server.
The default session time is 30 mins. When sliding expiration is true (that is the default), authentication timeout is extended for every request made to the server only after the first half of the total authentication time. The extension time is another 30 mins.
The above, is implemented in web.config as follows:
    <authentication mode="Forms">
      <forms domain="" name="AuthCookie" />
    </authentication>
    <sessionState mode="InProc" cookieless="false" />
Consider the following schema:
Session        [....................] 20' (default timeout)
                <----- 20mins ----->        

                Sliding Expiration = TRUE, Works only for requests after the 2nd half
                              /
                             15'
Authentication [..............|...............] 30' (default timeout)
                <----------- 30mins --------->
               
The time proportion between Authentication duration and Session duration is 30/20 = 1.5 which is the default value adopted by Microsoft.
               
Let assume the following:
1. Suppose that we have created a web application on asp.net X where X in (2, 3, 3.5 or 4).
2. We are also supposing that this application is using the default membership provider provided by Microsoft.
3. Our login form requires username, password and the user's full name. I use session to store the last one since username and password are part of the default membership and they are handled via System.Security.Principal.IIdentity, but full name not. Someone could suggest to extent the above membership in order to handle the user's full name (or other related fields) but this will break the scope of this article which is to show some traps of the usage of session variables.

Thus, the user's full name is stored on a session variable immediately after a successful login as follows:
...
Session("UserFullname") = txtFullname.text
...

Suppose that a the user login to our application at 12:00am. After his login the user waits for a number of minutes before send make a new action, i.e. send a new request to the web server. Our program may have different baehaviour depending of this number of minutes. Consider the following cases:

Case I: User sends his last request at 12:16 (16 minutes after authentication )
In this case the session duration will remain lower than the authentication duration (initial state).

                            User
                         request         
             12:00         12:16                               timeout
Authentication [..............|^.............................] 12:46
                               <------------ 30mins -------->

                                                     timeout
Session        [..............[....................] 12:36
                               <----- 20mins ----->
Supposing that the user always send a request to the server at the second half of the authentication duration then we can always be sure that our session variable 'UserFullname' will have the correct value.
                              

Case II: User sends a request at 12:14 (14 minutes after authentication)
In this case the session duration will be greater than the authentication duration.

                          User
                       request
              12:00      12:14                timeout
Authentication [.............^|...............] 12:30
                <------------ 30mins -------->
                                                        timeout
Session        [........................................] 12:40 (refreshed)
                <----- 20mins -----><----- 20mins ----->

This means this: From 12:30 to 12:40 our session variable 'UserFullname' will be invalid (empty).

The time proportion between Authentication duration and Session duration is 30/40 = 0.75.

According to the above we can conclude that:
If the proportion of authentication and session duration is lower than zero and Sliding Expiration is set to 'true' then there is a high possibility to "loose" our session variables or it is not safe to base the logic of our web application in session variables.