A session vanishes when its session cookie expires in the user's browser. It also can expire after a certain amount of time if you implement that in your server.

To set an idle timeout of, let's say, 300 seconds, you do this. On every hit to your server you send the session cookie again with an expiration time of now+300 seconds. If the user doesn't hit the server again before the cookie expires, the next hit will not have the cookie and so the user won't appear to be logged in .

To set an overall timeout (max session timeout) you use server code...