diff --git a/httpd/httpd.c b/httpd/httpd.c
index 74c11148..761d6863 100644
--- a/httpd/httpd.c
+++ b/httpd/httpd.c
@@ -750,6 +750,10 @@ void handle_post(void)
 			return;
 		}
 		if (is_word(request_path, "upload")) {
+			if (!authenticated) {
+				send_unauthorized();
+				return;
+			}
 			if (flash_size < FIRMWARE_UPLOAD_START*2)
 			{
 				print_string("Flash too small for firmware upload!\n");