diff --git a/http/websocket.hpp b/http/websocket.hpp
index 9a5aa29..8774200 100644
--- a/http/websocket.hpp
+++ b/http/websocket.hpp
@@ -101,8 +101,7 @@
             if (session != nullptr)
             {
                 // use protocol for csrf checking
-                if (session->cookieAuth &&
-                    !crow::utility::constantTimeStringCompare(
+                if (!crow::utility::constantTimeStringCompare(
                         protocol, session->csrfToken))
                 {
                     BMCWEB_LOG_ERROR << "Websocket CSRF error";
diff --git a/include/sessions.hpp b/include/sessions.hpp
index 62700be..99a1a0e 100644
--- a/include/sessions.hpp
+++ b/include/sessions.hpp
@@ -39,7 +39,6 @@
     std::string clientIp;
     std::chrono::time_point<std::chrono::steady_clock> lastUpdated;
     PersistenceType persistence{PersistenceType::TIMEOUT};
-    bool cookieAuth = false;
     bool isConfigureSelfOnly = false;
 
     // There are two sources of truth for isConfigureSelfOnly:
@@ -256,7 +255,7 @@
         auto session = std::make_shared<UserSession>(UserSession{
             uniqueId, sessionToken, std::string(username), csrfToken, clientId,
             redfish::ip_util::toString(clientIp),
-            std::chrono::steady_clock::now(), persistence, false,
+            std::chrono::steady_clock::now(), persistence,
             isConfigureSelfOnly});
         auto it = authTokens.emplace(sessionToken, session);
         // Only need to write to disk if session isn't about to be destroyed.