diff --git a/api/auth.py b/api/auth.py
index 9c4ddcf4..480f3659 100644
--- a/api/auth.py
+++ b/api/auth.py
@@ -217,7 +217,7 @@ def check_auth(handler, parsed) -> bool:
     if not is_auth_enabled():
         return True
     # Public paths don't require auth
-    if parsed.path in PUBLIC_PATHS or parsed.path.startswith('/static/'):
+    if parsed.path in PUBLIC_PATHS or parsed.path.startswith('/static/') or parsed.path.startswith('/session/static/'):
         return True
     # Check session cookie
     cookie_val = parse_cookie(handler)
diff --git a/api/routes.py b/api/routes.py
index 8ca1ccd6..1fd39d6f 100644
--- a/api/routes.py
+++ b/api/routes.py
@@ -1111,6 +1111,11 @@ def _handle_insights(handler, parsed) -> bool:
 def handle_get(handler, parsed) -> bool:
     """Handle all GET routes. Returns True if handled, False for 404."""
 
+    if parsed.path.startswith("/session/static/"):
+        from urllib.parse import urlparse as _up
+        stripped = parsed._replace(path=parsed.path[len("/session"):])
+        return _serve_static(handler, stripped)
+
     if parsed.path in ("/", "/index.html") or parsed.path.startswith("/session/"):
         from urllib.parse import quote
         from api.updates import WEBUI_VERSION