diff --git a/panel/io/application.py b/panel/io/application.py
index e6abd6e595..ee8906ad56 100644
--- a/panel/io/application.py
+++ b/panel/io/application.py
@@ -98,7 +98,7 @@ def process_request(self, request) -> dict[str, Any]:
         '''
         request_data = super().process_request(request)
         user = request.cookies.get('user')
-        if user:
+        if user and config.cookie_secret:
             from tornado.web import decode_signed_value
             try:
                 user = decode_signed_value(config.cookie_secret, 'user', user.value).decode('utf-8')