diff --git a/oauthproxy.go b/oauthproxy.go
index 43d3e52..2c65131 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -484,7 +484,7 @@ func (p *OauthProxy) Proxy(rw http.ResponseWriter, req *http.Request) {
 		}
 	}
 
-	if saveSession && session.Email != "" && !p.Validator(session.Email) {
+	if session != nil && session.Email != "" && !p.Validator(session.Email) {
 		log.Printf("%s Permission Denied: removing session %s", remoteAddr, session)
 		session = nil
 		saveSession = false