What happens to a session when we close the browser ?
It is it removed by AppServer when session times out ? or browser sends a message to Server that it is being closed, so that Appserver can remove that corresponding session.
The browser does not inform the server when it exits. Your options are:
1) Really on session timeout.
2) Create a "logout" page, so that the user can inform the server that they are done. The server can then call session.invalidate() to destroy the session.
In practice, you may want to do both, since user's frequently neglect to logout of web applications.