diff --git a/lib/roles/http/client/client-http.c b/lib/roles/http/client/client-http.c
index 5f746a425..d88611dce 100644
--- a/lib/roles/http/client/client-http.c
+++ b/lib/roles/http/client/client-http.c
@@ -721,7 +721,7 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 	int n, port = 0, ssl = 0;
 	int close_reason = LWS_CLOSE_STATUS_PROTOCOL_ERR;
 	const char *prot, *ads = NULL, *path, *cce = NULL;
-	struct allocated_headers *ah;
+	struct allocated_headers *ah, *ah1;
 	struct lws *w = lws_client_wsi_effective(wsi);
 	struct lws *nwsi = lws_get_network_wsi(wsi);
 	char *p, *q;
@@ -1016,10 +1016,12 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 		 * we seem to be good to go, give client last chance to check
 		 * headers and OK it
 		 */
+		ah1 = w->http.ah;
+		w->http.ah = ah;
 		if (w->protocol->callback(w,
 				LWS_CALLBACK_CLIENT_FILTER_PRE_ESTABLISH,
 					    w->user_space, NULL, 0)) {
-
+			w->http.ah = ah1;
 			cce = "HS: disallowed by client filter";
 			goto bail2;
 		}
@@ -1033,10 +1035,13 @@ lws_client_interpret_server_handshake(struct lws *wsi)
 		if (w->protocol->callback(w,
 					    LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP,
 					    w->user_space, NULL, 0)) {
+			w->http.ah = ah1;
 			cce = "HS: disallowed at ESTABLISHED";
 			goto bail3;
 		}
 
+		w->http.ah = ah1;
+
 		/*
 		 * for pipelining, master needs to keep his ah... guys who
 		 * queued on him can drop it now though.