It does work by either having a meta refresh, or a JavaScript, that continually send request to hold your session alive.
Basically, it works by having a session identifier, that is a random string. This session identifier might be valid for lets say 3 minutes.
Each minute, that webpage will either execute JavaScript code, or do a meta refresh, causing the page to get a new session identifier that is valid for Another 3 minutes.
The reason it knows you have closed the window, is that the session will no longer be renewed, thus your session will expire.
The reason of using such a system, is to prevent people from spoofing MAC-adresses and IP-adresses to "steal" a other's login session.
The popup is often delivered over HTTPS, so once the original user stops using the session, theres no way for the attacker to keep the session alive.
In some cases, a interlock scheme is used instead of HTTPS (or sometimes in combination), which consist of a JavaScript which is constructed to do some Exchange of secrets with the server each session renew, in a way so it requires a MITM attack to subdue the system.