Getting an error when using req.session.userID - node.js

Question

I'm using req.session.userID variable to set a sessionID for the user.
My code is
On the server side,
router.post('/signin', bodyParser.json(),function(req, res){
var db = req.db;
var collection = db.get('userCollection');
var name = req.body.name;
var password = req.body.password;
name = name.trim();
password = password.trim();
collection.find({"name":name}, {}, function(e1, username){
if (e1 === null){
if (username[0].password == password) {
req.session.userID = username[0]._id;
var string2 = "before session" + req.session.userID + "after session" + username[0]._id;
res.send(string2);
}
else {
res.send("Failure!");
}
}
});
And on the client side
router.post('/signin', bodyParser.json(),function(req, res){
var db = req.db;
var collection = db.get('userCollection');
var name = req.body.name;
var password = req.body.password;
name = name.trim();
password = password.trim();
collection.find({"name":name}, {}, function(e1, username){
if (e1 === null){
if (username[0].password == password) {
req.session.userID = username[0]._id;
var string2 = "before session" + req.session.userID + "after session" + username[0]._id;
res.send(string2);
}
else {
res.send("Failure!");
}
}
});
I have also set a secret token for in my app.js as advised in some other answers, but still whenever I user req.session.userID it gives me an error.
The moment I remove req.session.userID and just send a normal statement back it works. Can anyone tell me what could be the possible reason for this.
My app.js looks something like this...
var session = require('express-session');
app.use(session({
secret: 'secret token'
}))
I have even installed express-session. Should I be doing something else too?
Full app.js code,
var createError = require('http-errors');
var express = require('express');
var path = require('path');
var cookieParser = require('cookie-parser');
var session = require('express-session');
var mongo = require('mongodb');
var monk = require('monk');
var db = monk('localhost:27017/learnproject1');
var logger = require('morgan');
var bodyParser = require('body-parser');
var indexRouter = require('./routes/myroutes.js');
//var userRouter = require('.')
var app = express();
// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'pug');
app.use(logger('dev'));
app.use(express.json());
app.use(express.urlencoded({ extended: false }));
app.use(cookieParser());
app.use(express.static(path.join(__dirname, 'public')));
app.use(bodyParser.json());
app.use(function(req,res,next){
req.db = db;
next();
});
app.use('/', indexRouter);
//app.use('/users', usersRouter);
// catch 404 and forward to error handler
app.use(function(req, res, next) {
next(createError(404));
});
app.use(session({
secret: 'secret token'
}))
// error handler
app.use(function(err, req, res, next) {
// set locals, only providing error in development
res.locals.message = err.message;
res.locals.error = req.app.get('env') === 'development' ? err : {};
// render the error page
res.status(err.status || 500);
res.render('error');
});
module.exports = app;