NodeJS Expres + RedisStore , Request Session is always undefined

i did see some similar questions , but nine could solve my problem !

req.session is always undefined in nodeJS Express app . using latest version on express / connect-redis / and express-session packages .

var express = require('express') ;
var app = express() ;
var port = process.env.PORT || 8008  ;
var mongoose = require('mongoose') ;
var cookieParser = require('cookie-parser') ;
var bodyParser   = require('body-parser');
var session      = require('express-session') ;
var RedisStore = require('connect-redis')(session);
var Hash = require('password-hash') ;
var helmet = require('helmet') ;


app.use(express.static(__dirname + "/view" )) ;
app.use(cookieParser() );
app.use(bodyParser()) ;
app.use(session({
        saveUninitialized: true,
        resave: true ,
        store: new RedisStore({
            host: 'localhost',
            port: 7379,
            db: 2,
            pass: 'somePassworD'
        }),
        secret: 'someSecret' ,
        //cookie: { secure: true}
    })
);

app.use(helmet()) ;
app.use(function (req, res, next) {
    res.locals.csrftoken = req.session._csrf; 
    next();
}) ;

Error Message :

TypeError: Cannot read property '_csrf' of undefined

CSRF token will be present, when you use https://www.npmjs.org/package/csurf middleware

var express = require('express') ;
var app = express() ;
var port = process.env.PORT || 8008  ;
var csrf    = require('csurf')
var mongoose = require('mongoose') ;
var cookieParser = require('cookie-parser') ;
var bodyParser   = require('body-parser');
var session      = require('express-session') ;
var RedisStore = require('connect-redis')(session);
var Hash = require('password-hash') ;
var helmet = require('helmet') ;


app.use(express.static(__dirname + "/view" )) ;
app.use(cookieParser() );
app.use(bodyParser()) ;
app.use(session({
        saveUninitialized: true,
        resave: true ,
        store: new RedisStore({
            host: 'localhost',
            port: 7379,
            db: 2,
            pass: 'somePassworD'
        }),
        secret: 'someSecret' ,
        //cookie: { secure: true}
    })
);

app.use(csrf()); 

app.use(helmet()) ;
app.use(function (req, res, next) {
    res.locals.csrftoken = req.session._csrf; 
    next();
}) ;