diff --git a/include/libwebsockets/lws-secure-streams.h b/include/libwebsockets/lws-secure-streams.h
index f0b2b4032..eafdb136c 100644
--- a/include/libwebsockets/lws-secure-streams.h
+++ b/include/libwebsockets/lws-secure-streams.h
@@ -420,6 +420,18 @@ lws_ss_state_name(int state);
 LWS_VISIBLE LWS_EXTERN struct lws_context *
 lws_ss_get_context(struct lws_ss_handle *h);
 
+/**
+ * lws_ss_to_user_object() - convenience helper to get user object from handle
+ *
+ * \param h: secure streams handle
+ *
+ * Returns the user allocation related to the handle.  Normally you won't need
+ * this since it's available in the rx, tx and state callbacks as "userdata"
+ * already.
+ */
+LWS_VISIBLE LWS_EXTERN void *
+lws_ss_to_user_object(struct lws_ss_handle *h);
+
 /**
  * lws_ss_rideshare() - find the current streamtype when types rideshare
  *
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index b93158aca..3c8eff3f7 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -480,6 +480,12 @@ lws_ss_create(struct lws_context *context, int tsi, const lws_ss_info_t *ssi,
 	return 0;
 }
 
+void *
+lws_ss_to_user_object(struct lws_ss_handle *h)
+{
+	return (void *)&h[1];
+}
+
 void
 lws_ss_destroy(lws_ss_handle_t **ppss)
 {