One common method is to set an expiration time on the session, you could set a timestamp value in mongo for this.

On request check that the session id hasn't timed out (time_now < timestamp)...

• If session is timed out: deny the request and redirect to login
• If session is not timed out: set new session timeout (something like 10 minutes into the future), and reply to request

You can prevent the user from being auto logged out by having your front end send a request in the background on an interval shorter than the session timeout window.