Sites usually send cookies that expire automatically. So the user gets logged off in that time. However, the user is logged off even if they are active. So you may have to do something a little more involved.
When you receive the cookie from the user, check the last time it was sent (You'll have to do this by writing sessionID, timestamp pairs into a db). If the user was idle for more than x minutes, log them off.. So every time the user navigates, the timer sets again.
