How do you check if a user is logged in?

Check whether the session holds a user variable that was set at login.

if (!req.session.hasOwnProperty('user')) {
  message = 'No user logged in.';
} else {
  message = 'User "' + req.session.user + '" logged in.';
}

Use this check at the beginning of any route that requires authentication. If not logged in, redirect to the login page or return a 401 Unauthorized response.