diff --git a/CHANGELOG b/CHANGELOG
index 65aa1b9b07c4d8866dd60a3b828bb320828d6069..b7489356167db6ebc3dde0f952f0b30cf770ba03 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -49,6 +49,8 @@ minerva (14.0.0~beta.0) unstable; urgency=low
   * Bug fix: too long name for data overlay in info window is trimmed (#919)
   * Bug fix: too long name in general overlay list is wrapped (#857)
   * Bug fix: after genome is removed list of genomes is refreshed (#922)
+  * Bug fix: when session expired anonymous user could access admin panel with
+    very limited access (#928)
 
  -- Piotr Gawron <piotr.gawron@uni.lu>  Mon, 21 Aug 2019 21:00:00 +0200
 
diff --git a/frontend-js/src/main/js/minerva.js b/frontend-js/src/main/js/minerva.js
index d79a2d7c26cd7ee912d153ab9a7534f7a5cd1830..15f20b4ad35de07144f22a2bb6293e610bab9c7c 100644
--- a/frontend-js/src/main/js/minerva.js
+++ b/frontend-js/src/main/js/minerva.js
@@ -882,16 +882,15 @@ function createAdmin(params) {
   params.getElement().style.display = "table";
   params.getElement().innerHTML = "<div style='vertical-align:middle;display:table-cell;text-align: center'>"
     + "<img src='resources/images/icons/ajax-loader.gif'/>" + "</div>";
-  if (ServerConnector.getSessionData(null).getLogin() === "anonymous" ||
-    ServerConnector.getSessionData(null).getLogin() === null ||
-    ServerConnector.getSessionData(null).getLogin() === undefined) {
-    window.location.href = ServerConnector.getServerBaseUrl() + "login.xhtml?from=" + encodeURI(window.location.href);
-    return Promise.resolve()
-  }
 
   var result;
   // make sure that we are logged in
   return ServerConnector.createSession().then(function () {
+    if (ServerConnector.getSessionData(null).getLogin() === "anonymous" ||
+      ServerConnector.getSessionData(null).getLogin() === null ||
+      ServerConnector.getSessionData(null).getLogin() === undefined) {
+      window.location.href = ServerConnector.getServerBaseUrl() + "login.xhtml?from=" + encodeURI(window.location.href);
+    }
     return ServerConnector.getConfiguration();
   }).then(function (configuration) {
     params.setConfiguration(configuration);