diff --git a/lib/secure-streams/system/auth-api.amazon.com/auth.c b/lib/secure-streams/system/auth-api.amazon.com/auth.c
index 1f0365b47..3ad8d8d4b 100644
--- a/lib/secure-streams/system/auth-api.amazon.com/auth.c
+++ b/lib/secure-streams/system/auth-api.amazon.com/auth.c
@@ -200,19 +200,23 @@ ss_api_amazon_auth_state(void *userobj, void *sh, lws_ss_constate_t state,
 {
 	ss_api_amazon_auth_t *m = (ss_api_amazon_auth_t *)userobj;
 	struct lws_context *context = (struct lws_context *)m->opaque_data;
+	lws_system_blob_t *ab;
 	size_t s;
 
 	lwsl_info("%s: %s, ord 0x%x\n", __func__, lws_ss_state_name(state),
 		  (unsigned int)ack);
 
+	ab = lws_system_get_blob(context, LWS_SYSBLOB_TYPE_AUTH, AUTH_IDX_ROOT);
+	/* coverity */
+	if (!ab)
+		return LWSSSSRET_DESTROY_ME;
+
 	switch (state) {
 	case LWSSSCS_CREATING:
         	lws_ss_set_metadata(m->ss, "ctype", "application/json", 16);
 		/* fallthru */
 	case LWSSSCS_CONNECTING:
-		s = lws_system_blob_get_size(
-			lws_system_get_blob(context, LWS_SYSBLOB_TYPE_AUTH,
-					    AUTH_IDX_ROOT));
+		s = lws_system_blob_get_size(ab);
 		lws_ss_request_tx_len(m->ss, (unsigned long)s);
 		m->pos = 0;
 		break;
@@ -230,9 +234,7 @@ ss_api_amazon_auth_state(void *userobj, void *sh, lws_ss_constate_t state,
 		 * when the close process for the auth wsi has completed and
 		 * the related tls is already freed.
 		 */
-		s = lws_system_blob_get_size(
-			lws_system_get_blob(context, LWS_SYSBLOB_TYPE_AUTH,
-					    AUTH_IDX_LWA));
+		s = lws_system_blob_get_size(ab);
 
 		if (s && context->mgr_system.state != LWS_SYSTATE_OPERATIONAL)
 			lws_sul_schedule(context, 0,