With regards to the cancel Notification being sent, I can confirm that this was a known issue in App Portal 2017 (and 2018). The issue was being tracked under issue number IOJ-1896164. The issue has been fixed in App Broker 2019R1, which was released a little over a week ago..
As mentioned previously, there is a setting in IIS which controls both the session time-out and the idle time-out for the Application pool itself.. The session timeout is probably the most applicable to your question, and can be seen in the attached SessionTimeout.png. The idle time-out can be seen in the screen capture named IdleTimeout.png.. A setting of "0" means that the application pool will not timeout due to a lack of activity.