diff --git a/server/authorization.ts b/server/authorization.ts
index 07eb575..6d71dc3 100644
--- a/server/authorization.ts
+++ b/server/authorization.ts
@@ -17,7 +17,7 @@ export type RequirePermissionOptions = RequireAuthOptions & {
 export function requireAuth(options: RequireAuthOptions = {}) {
   return async (req: Request, res: Response, next: NextFunction) => {
     // Check for session authentication
-    if (req.isAuthenticated()) {
+    if (typeof req.isAuthenticated === 'function' && req.isAuthenticated()) {
       return next();
     }
 
diff --git a/server/ldap-query-builder-routes.ts b/server/ldap-query-builder-routes.ts
index e23fb8e..e4e8df7 100644
--- a/server/ldap-query-builder-routes.ts
+++ b/server/ldap-query-builder-routes.ts
@@ -14,7 +14,14 @@ import { InsertLdapQuery, LdapQuery, InsertLdapQueryVersion } from "@shared/sche
 function hasPermission(permission: string) {
   return (req: any, res: any, next: any) => {
     // Check if the user is authenticated via passport session or has a valid API token
-    if (req.user || req.headers.authorization) {
+    if (
+      // Check for authenticated session (safely check if isAuthenticated is a function first)
+      (typeof req.isAuthenticated === 'function' && req.isAuthenticated()) ||
+      // Or check for existing user object (set by token auth)
+      req.user ||
+      // Or check for authorization header (token auth)
+      req.headers.authorization
+    ) {
       // In a real implementation, this would check the user's permissions against the required permission
       return next();
     }