Right, my interpretation of this is, and please correct if I'm wrong: user has had their laptop stolen, and they have lots of sessions on web sites open, perhaps because they checked the remember me box, or just like having lots of tabs open. User now wants to ensure that person who stole laptop can't use their sessions, by closing the remote sessions in some way.
They can't clear the cookies, because they don't have the device the cookies are stored on. Therefore, they are at the mercy of the web application developers. There are several possibilities here:
- Application provides a session management system, where user can log in, see active sessions, and close them if they want to. In this case, they should log in, close any other sessions and, just to be on the safe side, check whether any unwanted activity occurred on the account. An example of this type of site would be Facebook.
- Application only allows one instance of each user to be logged in at any given time. This is avoiding concurrent logins, and is generally a good thing to support if the application involves any form of transactions, whether financial or otherwise. In this case, simply log in. Any other active sessions will be terminated. Most banks operate like this, although they also tend to have short session expiry periods.
- If the application has a short session expiry (say the laptop was grabbed whilst you were making an online banking transaction), it's only a problem if they can use the account quickly. If they can't, the session will be terminated soon anyway.
- If the application combines a session token with a client identifier, that doesn't really help with this circumstance. In theory there could be applications where you can block specific client identifiers, but every instance of client identifiers I've personally come across have been in conjunction with a session management system.
- If none of the above are true, try logging into the application and changing your password. Well developed systems will expire any open sessions at that point. It may be worth testing this by opening two sessions of your own (perhaps in distinct browsers) and seeing if the session in the browser you don't use to change the password is closed when you do - the stolen session should do the same.
- If that doesn't work, there isn't much you can do - the application doesn't support session expiry in a user accessible way. Contact the application owner and ask if they can manually clear that session, but I wouldn't hold out much hope.
In short, there isn't a standard way which works for all sites if you can't delete the cookies.