diff --git a/http/http_connection.hpp b/http/http_connection.hpp
index b2096d4..028222e 100644
--- a/http/http_connection.hpp
+++ b/http/http_connection.hpp
@@ -102,10 +102,12 @@
         // don't require auth
         if (preverified)
         {
-            userSession = verifyMtlsUser(req->ipAddress, ctx);
-            if (userSession)
+            mtlsSession = verifyMtlsUser(req->ipAddress, ctx);
+            if (mtlsSession)
             {
-                sessionIsFromTransport = true;
+                BMCWEB_LOG_DEBUG
+                    << this
+                    << " Generating TLS session: " << mtlsSession->uniqueId;
             }
         }
         return true;
@@ -280,13 +282,13 @@
                                          boost::asio::ip::tcp::socket>>)
         {
             adaptor.next_layer().close();
-            if (sessionIsFromTransport && userSession != nullptr)
+            if (mtlsSession != nullptr)
             {
                 BMCWEB_LOG_DEBUG
                     << this
-                    << " Removing TLS session: " << userSession->uniqueId;
+                    << " Removing TLS session: " << mtlsSession->uniqueId;
                 persistent_data::SessionStore::getInstance().removeSession(
-                    userSession);
+                    mtlsSession);
             }
         }
         else
@@ -465,11 +467,10 @@
             {
                 BMCWEB_LOG_DEBUG << "Unable to get client IP";
             }
-            sessionIsFromTransport = false;
 #ifndef BMCWEB_INSECURE_DISABLE_AUTHX
             boost::beast::http::verb method = parser->get().method();
             userSession = crow::authentication::authenticate(
-                ip, res, method, parser->get().base(), userSession);
+                ip, res, method, parser->get().base(), mtlsSession);
 
             bool loggedIn = userSession != nullptr;
             if (!loggedIn)
@@ -550,12 +551,7 @@
                                                   // newly created parser
             buffer.consume(buffer.size());
 
-            // If the session was built from the transport, we don't need to
-            // clear it.  All other sessions are generated per request.
-            if (!sessionIsFromTransport)
-            {
-                userSession = nullptr;
-            }
+            userSession = nullptr;
 
             // Destroy the Request via the std::optional
             req.reset();
@@ -628,8 +624,8 @@
     std::optional<crow::Request> req;
     crow::Response res;
 
-    bool sessionIsFromTransport = false;
     std::shared_ptr<persistent_data::UserSession> userSession;
+    std::shared_ptr<persistent_data::UserSession> mtlsSession;
 
     boost::asio::steady_timer timer;