diff --git a/include/authentication.hpp b/include/authentication.hpp
index 0e5e880..9e3405b 100644
--- a/include/authentication.hpp
+++ b/include/authentication.hpp
@@ -156,6 +156,7 @@
     {
         return nullptr;
     }
+    sessionOut->cookieAuth = true;
 #ifndef BMCWEB_INSECURE_DISABLE_CSRF_PREVENTION
     // RFC7231 defines methods that need csrf protection
     if (method != boost::beast::http::verb::get)