If you do not set an expiration time for the session-cookie, the browser will delete it whenever the browser is closed.
Set-Cookie: SessionId=1ogf87b04oajp1lvkrid2iciskd2acug; path=/; HttpOnly
This leaves you with the question of expiring the session.
This should be done by server-side check: On each (valid) request, store the request time in/for this session. Whenever a subsequent request is made, check the current time against the previous request time. If the last activity was more than X minutes ago, consider the session expired and explicitly expire the session cookie by setting an expiration time far back. Setting a cookie expiration time far back in the past (1971-01-01 for example) will tell the client it can garbage collect the session cookie, while still making sure you do the actual expiring on the server side.
Set-Cookie: SessionId=false; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
You should not rely on any client scripting or the like, it is not needed for session management (and cannot be implemented reliable anyhow).
Edited to add:
Some frameworks have a good session implementation, while most do an OK-ish job. However, some (I'm looking at you Zend Framework) are downright wrong. Try to make sure you understand what cookies are send out and do not confuse the session cookie with, for example, a 'remember me' cookie.