diff --git a/http/websocket.hpp b/http/websocket.hpp
index 363076e..446db1b 100644
--- a/http/websocket.hpp
+++ b/http/websocket.hpp
@@ -100,14 +100,17 @@
                 boost::beast::websocket::response_type& m) {
 
 #ifndef BMCWEB_INSECURE_DISABLE_CSRF_PREVENTION
-                // use protocol for csrf checking
-                if (session->cookieAuth &&
-                    !crow::utility::constantTimeStringCompare(
-                        protocol, session->csrfToken))
+                if (session != nullptr)
                 {
-                    BMCWEB_LOG_ERROR << "Websocket CSRF error";
-                    m.result(boost::beast::http::status::unauthorized);
-                    return;
+                    // use protocol for csrf checking
+                    if (session->cookieAuth &&
+                        !crow::utility::constantTimeStringCompare(
+                            protocol, session->csrfToken))
+                    {
+                        BMCWEB_LOG_ERROR << "Websocket CSRF error";
+                        m.result(boost::beast::http::status::unauthorized);
+                        return;
+                    }
                 }
 #endif
                 if (!protocol.empty())