You can use the method invalidate() in HttpSession to invalidate a session. Not sure if this is what you are asking though.

mrighetti wrote:

I was referring to a way to call that method without the user's input, i.e. the user closes the browser without logging off.

As I said in class, a session can be dropped by either the client or the server, i.e. you don't have to do it on both sides. It's true that if the user closes the browser, the session is dropped, but the objects associated with the session will stay on the server until the session expires, which is a waste of server resources, and there's nothing can be done about it. In practice it's usually not a big deal though because the data associated with a session is usually not much.

mrighetti wrote:

Should we account for the instance of a user navigating away from the page but not closing their browser? 

That was the original scenario I meant to describe, but incorrectly said "close" versus "navigate away".

In that case the user could still come back so the session should be kept (until it expires) and nothing needs to be done.