diff --git a/lib/web/apiserver.go b/lib/web/apiserver.go
index a9dd1c558524d..6fdca750060f2 100644
--- a/lib/web/apiserver.go
+++ b/lib/web/apiserver.go
@@ -1999,8 +1999,6 @@ func (h *Handler) WithClusterAuth(fn ClusterHandler) httprouter.Handle {
 		ctx, err := h.AuthenticateRequest(w, r, true)
 		if err != nil {
 			log.Info(err)
-			// clear session just in case if the authentication request is not valid
-			ClearSession(w)
 			return nil, trace.Wrap(err)
 		}
 		siteName := p.ByName("site")