diff --git a/app/rest/auth/auth.go b/app/rest/auth/auth.go
index 558849b5..964a3569 100644
--- a/app/rest/auth/auth.go
+++ b/app/rest/auth/auth.go
@@ -75,7 +75,7 @@ func (a *Authenticator) Auth(reqAuth bool) func(http.Handler) http.Handler {
 				return true
 			}()
 
-			if xsrfStatus {
+			if !xsrfStatus {
 				if reqAuth {
 					http.Error(w, "Unauthorized", http.StatusUnauthorized)
 					return