Assume that the web server creates a new session for a user, and later, the user does not "log out", but rather just closes the browser. How can the web server determine that this session is no longer active and prevent it from consuming valuable server resources?

Govind Seshadri

Answer by Alessandro A. Garbagnati
There is no "standard" way to have a count of all the "active" sessions in a servet container. You have top maintain your own, maybe using a map that stores the session when the user logs in and remove it when the user logs out.

If the user doesn't log out properly, you can check if the session is still valid based on computing the time difference between the default timeout interval (HttpSession.getMaxInactiveInterval()) and the last activity performed by the user (HttpSession.getLastAccessedTime()).