diff --git a/jupyter_server/base/handlers.py b/jupyter_server/base/handlers.py
index 9c95898b6..5605cfe75 100644
--- a/jupyter_server/base/handlers.py
+++ b/jupyter_server/base/handlers.py
@@ -506,6 +506,9 @@ def check_referer(self):
 
     def check_xsrf_cookie(self):
         """Bypass xsrf cookie checks when token-authenticated"""
+        if not hasattr(self, "_jupyter_user"):
+            # Called too early, will be checked later
+            return
         if self.token_authenticated or self.settings.get("disable_check_xsrf", False):
             # Token-authenticated requests do not need additional XSRF-check
             # Servers without authentication are vulnerable to XSRF
@@ -593,8 +596,11 @@ async def prepare(self):
 
         # self.current_user for tornado's @web.authenticated
         # self._jupyter_user for backward-compat in deprecated get_current_user calls
+        # and our own private checks for whether .current_user has been set
         self.current_user = self._jupyter_user = user
+        # complete initial steps which require auth to resolve first:
         self.set_cors_headers()
+        self.check_xsrf_cookie()
         return super().prepare()
 
     # ---------------------------------------------------------------