diff --git a/src/api.rs b/src/api.rs
index b3083ca..50ed3d9 100644
--- a/src/api.rs
+++ b/src/api.rs
@@ -237,8 +237,10 @@ impl Handler for AuthHandler {
 					if let Some(ref password) = auth.password {
 						auth_success =
 							user::auth(self.db.deref(), auth.username.as_str(), password.as_str())?;
-						req.extensions
-							.insert::<SessionKey>(Session { username: auth.username.clone() });
+						if auth_success {
+							req.extensions
+								.insert::<SessionKey>(Session { username: auth.username.clone() });
+						}
 					}
 				}
 			}