best practices

Hi,

Normally in web application, when a user end his session, not logging
out, but simply closing the browser, the session token stay valid
until the session timed out, and so it's potentially reusable.

In my opinion it's recommendable that some kind of a mechanism is
implemented for invalidate the session token when user close the
browser, for example, with a client side javascript code using the
onunload event to invalidate the session token. But I haven't found a
best practices or any other discussion about this problem.

Best Regards,

Matteo Nava

-------------------------------------------------------------------------
Sponsored by: Watchfire

Securing a web application goes far beyond testing the application using 
manual processes, or by using automated systems and tools. Watchfire's 
"Web Application Security: Automated Scanning or Manual Penetration 
Testing?" whitepaper examines a few vulnerability detection methods - 
specifically comparing and contrasting manual penetration testing with 
automated scanning tools. Download it today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------