diff --git a/include/authorization.hpp b/include/authorization.hpp
index ecbdca0..ecc83fc 100644
--- a/include/authorization.hpp
+++ b/include/authorization.hpp
@@ -42,8 +42,14 @@
 {
     BMCWEB_LOG_DEBUG << "[AuthMiddleware] Basic authentication";
 
-    std::string authData;
+    if (!boost::starts_with(authHeader, "Basic "))
+    {
+        return nullptr;
+    }
+
     std::string_view param = authHeader.substr(strlen("Basic "));
+    std::string authData;
+
     if (!crow::utility::base64Decode(param, authData))
     {
         return nullptr;
@@ -91,7 +97,10 @@
     performTokenAuth(std::string_view authHeader)
 {
     BMCWEB_LOG_DEBUG << "[AuthMiddleware] Token authentication";
-
+    if (!boost::starts_with(authHeader, "Token "))
+    {
+        return nullptr;
+    }
     std::string_view token = authHeader.substr(strlen("Token "));
     auto sessionOut =
         persistent_data::SessionStore::getInstance().loginSessionByToken(token);
@@ -280,29 +289,25 @@
     }
 #endif
     std::string_view authHeader = reqHeader["Authorization"];
+    BMCWEB_LOG_ERROR << "authHeader=" << authHeader;
 
-    if (!authHeader.empty())
+    if (sessionOut == nullptr && authMethodsConfig.sessionToken)
     {
-        // Reject any kind of auth other than basic or token
-        if (boost::starts_with(authHeader, "Token ") &&
-            authMethodsConfig.sessionToken)
-        {
 #ifdef BMCWEB_ENABLE_SESSION_AUTHENTICATION
-            sessionOut = performTokenAuth(authHeader);
+        sessionOut = performTokenAuth(authHeader);
 #endif
-        }
-        else if (boost::starts_with(authHeader, "Basic ") &&
-                 authMethodsConfig.basic)
-        {
-#ifdef BMCWEB_ENABLE_BASIC_AUTHENTICATION
-            sessionOut = performBasicAuth(ipAddress, authHeader);
-#endif
-        }
-        if (sessionOut != nullptr)
-        {
-            return sessionOut;
-        }
     }
+    if (sessionOut == nullptr && authMethodsConfig.basic)
+    {
+#ifdef BMCWEB_ENABLE_BASIC_AUTHENTICATION
+        sessionOut = performBasicAuth(ipAddress, authHeader);
+#endif
+    }
+    if (sessionOut != nullptr)
+    {
+        return sessionOut;
+    }
+
     BMCWEB_LOG_WARNING << "[AuthMiddleware] authorization failed";
     forward_unauthorized::sendUnauthorized(url, reqHeader["User-Agent"],
                                            reqHeader["accept"], res);