Yeah, you need to get into the session timeout settings within your portlet-ext.properties file...
Basically I think the recommendation is to use a low session timeout (like 5 minutes) combined with the auto session extension settings.
The auto extend will keep the session alive while the browser is open. The low session timeout will cause the session to be cleaned up sooner when the user's browser has either closed or navigated away from Liferay.
These are the values that I use:
#
# Session settings
#
session.timeout=5
session.timeout.warning=1
session.timeout.auto.extend=true
session.timeout.redirect.on.expire=false
session.enable.persistent.cookies=true
# Disable for seo usage since we will use cookies.
session.enable.url.with.session.id=false
