diff --git a/addons/auth_totp/tests/test_totp.py b/addons/auth_totp/tests/test_totp.py
index 438ef6d142e..f3874fddd81 100644
--- a/addons/auth_totp/tests/test_totp.py
+++ b/addons/auth_totp/tests/test_totp.py
@@ -1,3 +1,4 @@
+import json
 import time
 from xmlrpc.client import Fault
 
@@ -84,3 +85,31 @@ class TestTOTP(HttpCase):
         self.start_tour('/web', 'totp_tour_setup', login='demo')
         self.start_tour('/web', 'totp_admin_disables', login='admin')
         self.start_tour('/', 'totp_login_disabled', login=None)
+
+    def test_totp_authenticate(self):
+        """
+        Ensure that JSON-RPC authentication works and don't return the user id
+        without TOTP check
+        """
+
+        self.start_tour('/web', 'totp_tour_setup', login='demo')
+        self.url_open('/web/session/logout')
+
+        headers = {
+            "Content-Type": "application/json",
+        }
+
+        payload = {
+            "jsonrpc": "2.0",
+            "method": "call",
+            "id": 0,
+            "params": {
+                "db": get_db_name(),
+                "login": "demo",
+                "password": "demo",
+                "context": {},
+            },
+        }
+        response = self.url_open("/web/session/authenticate", data=json.dumps(payload), headers=headers)
+        data = response.json()
+        self.assertEqual(data['result']['uid'], None)
diff --git a/addons/mail/models/ir_http.py b/addons/mail/models/ir_http.py
index 893533f96e7..af118ec8385 100644
--- a/addons/mail/models/ir_http.py
+++ b/addons/mail/models/ir_http.py
@@ -18,7 +18,7 @@ class IrHttp(models.AbstractModel):
         assets_discuss_public_hash = HomeStaticTemplateHelpers.get_qweb_templates_checksum(debug=request.session.debug, bundle='mail.assets_discuss_public')
         result['cache_hashes']['assets_discuss_public'] = assets_discuss_public_hash
         guest = self.env.context.get('guest')
-        if self.env.user._is_public() and guest:
+        if not request.session.uid and guest:
             user_context = {'lang': guest.lang}
             mods = odoo.conf.server_wide_modules or []
             lang = user_context.get("lang")
diff --git a/addons/web/models/ir_http.py b/addons/web/models/ir_http.py
index 212fb0c64c0..bf764741aea 100644
--- a/addons/web/models/ir_http.py
+++ b/addons/web/models/ir_http.py
@@ -34,7 +34,7 @@ class Http(models.AbstractModel):
         ))
         mods = odoo.conf.server_wide_modules or []
         lang = user_context.get("lang")
-        translation_hash = request.env['ir.translation'].sudo().get_web_translations_hash(mods, lang)
+        translation_hash = request.env['ir.translation'].sudo().get_web_translations_hash(mods, lang) if request.session.uid else None
         session_info = {
             "uid": request.session.uid,
             "is_system": user._is_system() if request.session.uid else False,