The following info is from http://developers.sun.com/prodtech/javatools/jscreator/learning/tutorials/2/sco pes.html
To programmatically end a session, call session.invalidate()
To set the amount of time before a session times out use the session-timeout tag in the session-config. For example,
<session-config>
<session-timeout>10</session-timeout>
</session-config>
Closing a window or exiting the browser does not submit a page so there is no way for the web application on the server end to know automatically that this has happened.
You might want to search JavaScript forums to see if there is some type of JavaScript for detecting that the browser is closing and thus navigating to some servlet that invalidates the session.