diff --git a/src/sbbs3/websrvr.c b/src/sbbs3/websrvr.c
index b69030b4edf6dbe5519d0971091a6022fff726d1..0ad6fe0df361c479ba68c7f006cf7b52a2370788 100644
--- a/src/sbbs3/websrvr.c
+++ b/src/sbbs3/websrvr.c
@@ -833,14 +833,16 @@ static BOOL check_ars(http_session_t * session)
 	char	*password;
 	uchar	*ar;
 	BOOL	authorized;
+	char	auth_req[MAX_REQUEST_LINE];
 
 	if(session->req.auth[0]==0) {
 		if(startup->options&WEB_OPT_DEBUG_RX)
 			lprintf(LOG_NOTICE,"%04d !No authentication information",session->socket);
 		return(FALSE);
 	}
+	SAFECOPY(auth_req,session->req.auth);
 
-	username=strtok(session->req.auth,":");
+	username=strtok(auth_req,":");
 	if(username==NULL)
 		username="";
 	password=strtok(NULL,":");