diff --git a/pkg/handler/handler.go b/pkg/handler/handler.go
index 9be0aba..4f7909d 100644
--- a/pkg/handler/handler.go
+++ b/pkg/handler/handler.go
@@ -42,10 +42,10 @@ type Standalone struct {
 }
 
 func NewStandalone(
-	cfg *config.Config,
-	jwksProvider openidclient.JwksProvider,
-	openidConfig openidconfig.Config,
-	crypter crypto.Crypter,
+		cfg *config.Config,
+		jwksProvider openidclient.JwksProvider,
+		openidConfig openidconfig.Config,
+		crypter crypto.Crypter,
 ) (*Standalone, error) {
 	autoLogin, err := autologin.New(cfg)
 	if err != nil {
@@ -443,12 +443,18 @@ func (s *Standalone) SessionForwardAuth(w http.ResponseWriter, r *http.Request)
 	_, err := s.GetSession(r)
 	if err != nil {
 		logger := mw.LogEntryFrom(r)
-		if errors.Is(err, session.ErrInvalidExternal) || errors.Is(err, session.ErrInvalid) || errors.Is(err, session.ErrNotFound) {
+		if errors.Is(err, session.ErrInvalidExternal) || errors.Is(err, session.ErrInvalid) {
 			logger.Infof("session/forwardauth: %+v", err)
 			w.WriteHeader(http.StatusUnauthorized)
 			return
 		}
 
+		if errors.Is(err, session.ErrNotFound) {
+			logger.Debugf("session/forwardauth: %+v", err)
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+
 		logger.Warnf("session/forwardauth: %+v", err)
 		w.WriteHeader(http.StatusInternalServerError)
 		return