diff --git a/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/OAuthFilter.java b/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/OAuthFilter.java
index 548847b..e5d34bf 100644
--- a/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/OAuthFilter.java
+++ b/github-oauth/src/main/java/com/googlesource/gerrit/plugins/github/oauth/OAuthFilter.java
@@ -240,7 +240,7 @@
   }
 
   private Cookie getGerritCookie(HttpServletRequest httpRequest) {
-    for (Cookie cookie : httpRequest.getCookies()) {
+    for (Cookie cookie : getCookies(httpRequest)) {
       if (cookie.getName().equalsIgnoreCase(GERRIT_COOKIE_NAME)) {
         return cookie;
       }
@@ -248,9 +248,14 @@
     return null;
   }
 
+  private Cookie[] getCookies(HttpServletRequest httpRequest) {
+    Cookie[] cookies = httpRequest.getCookies();
+    return cookies == null ? new Cookie[0]:cookies;
+  }
+
   private OAuthCookie getOAuthCookie(HttpServletRequest request,
       HttpServletResponse response) {
-    for (Cookie cookie : request.getCookies()) {
+    for (Cookie cookie : getCookies(request)) {
       if (cookie.getName().equalsIgnoreCase(OAuthCookie.OAUTH_COOKIE_NAME)
           && !Strings.isNullOrEmpty(cookie.getValue())) {
         try {