You have at least one other option, which is to not display a timer and to not show a message about timeout, unless the user resumes/continues after the timeout. Airline sites typically do this, and I prefer it. What choice you make depends on your audience and your objectives. Less net-savvy older people find comparing options and making bookings online stressful - and you want to reduce their stress. Younger net-savvy users enjoy more game-like interfaces. The dynamics of your ticket sales also comes into it. A timer is more appropriate when the tickets are sold over a short period. Airline tickets may sell months in advance.
The particular circumstances of your ticket sales matter a great deal.
More Detail
You're getting a wide range of opinions here. Mine is contrary to the general trend.
What is your objective:
- To avoid seats being 'reserved' but not bought?
- To frighten the user into buying the tickets quickly?
I've used airline ticket booking sites which tell you you've timed out if you take a long time. They tell you when you next click on something. They don't show a timeout timer at all. They don't warn that you need to be reasonably prompt. It just happens if you continue after too long a delay.
They are quite good about keeping other details like address and name, so it is not a major hassle to rebook, and that's important whatever tack you take.
Decide exactly what your objective is.
There is no must about showing a timer - and there are definite drawbacks.
Some Drawbacks to Showing a Timer
Some users will resent the timer. Also, do you want a longer timer for events that are not going to sell out? Someone might 'book' but then want to check with a colleague whether they want to come too, and only complete the booking more than ten minutes later. If you want to allow longer than ten minutes for a non sell out event, you probably don't want to advertise what is and isn't expected to be a sell out by showing the timer.
Timer More Work than it Looks
You probably have this already in hand, but the timeout needs to be handled on the server, not (only) the web page. Otherwise your competition can 'block book' everything and not pay anything. If you want to cater for no javascript enabled, you have to have a version that works without showing a timer too.