diff --git a/include/authentication.hpp b/include/authentication.hpp
index 5f43f0a..0617cf3 100644
--- a/include/authentication.hpp
+++ b/include/authentication.hpp
@@ -153,7 +153,7 @@
         }
         sessionOut->cookieAuth = true;
 
-        if constexpr (BMCWEB_INSECURE_DISABLE_CSRF)
+        if constexpr (!BMCWEB_INSECURE_DISABLE_CSRF)
         {
             // RFC7231 defines methods that need csrf protection
             if (method != boost::beast::http::verb::get)