Big picture question - The nature of Session state variables and keeping them alive.

I'm in a little bit of trouble here.  I'm writing a Dot Net 4.0 web app.  To the best of knowledge (correct me if I'm wrong) session state variables will expire if the web app does not do a postback before the timeout.
I need a way to keep my session state variables alive and so far it looks to me like what is needed is some sort of call back to the server to keep things alive.  (Something to detect key clicks and mouse moves, and trigger the call.)
My boss is of the opinion that all that coding is unnecessary.  He swears that he worked on a project in which all that was handled by settings in the web.config.
Which one of us is correct?
...