diff --git a/http/websocket.hpp b/http/websocket.hpp
index 0faa8c6..434a0c1 100644
--- a/http/websocket.hpp
+++ b/http/websocket.hpp
@@ -100,7 +100,8 @@
             if (session != nullptr)
             {
                 // use protocol for csrf checking
-                if (!crow::utility::constantTimeStringCompare(
+                if (session->cookieAuth &&
+                    !crow::utility::constantTimeStringCompare(
                         protocol, session->csrfToken))
                 {
                     BMCWEB_LOG_ERROR << "Websocket CSRF error";