UPDATE
So after reading both of your answers I realize there is no reliable way to determine when a browser window is closed. Originally I was
You can't count on onunload
handlers firing at all (it's not just Firefox). onbeforeunload
handlers are slightly more reliable, but only slightly.
Update Responding to your follow-up question: If you have to use a lock, then yes, I would definitely use a server-side timeout (you have no other choice; if the user's workstation blue-screens, for instance, you want that record unlocked at some point). You probably want to reset the timeout any time you see activity from the user (you could use an ajax ping while the page is open) and, as you said, give the user a means of explicitly releasing the record. How long that timeout should be is up to you, but if you used the ajax ping mechanism, no reason it would even need to be five minutes — you could do a one-minute timeout and a 30-second ajax ping, or even a 30-second timeout and a 15-second ping, whatever. Depends on what kind of load you want to put on the server.