diff --git a/addons/utm/models/ir_http.py b/addons/utm/models/ir_http.py
index 8e2fac4bf0f..7de6922c3b6 100644
--- a/addons/utm/models/ir_http.py
+++ b/addons/utm/models/ir_http.py
@@ -14,6 +14,9 @@ class IrHttp(models.AbstractModel):
     def _set_utm(cls, response):
         if isinstance(response, Exception):
             return response
+        # the parent dispatch might destroy the session
+        if not request.db:
+            return response
 
         domain = cls.get_utm_domain_cookies()
         for var, dummy, cook in request.env['utm.mixin'].tracking_fields():
diff --git a/addons/utm/tests/__init__.py b/addons/utm/tests/__init__.py
new file mode 100644
index 00000000000..37bd33ddc4d
--- /dev/null
+++ b/addons/utm/tests/__init__.py
@@ -0,0 +1,4 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from . import test_routes
diff --git a/addons/utm/tests/test_routes.py b/addons/utm/tests/test_routes.py
new file mode 100644
index 00000000000..8bf70d72c93
--- /dev/null
+++ b/addons/utm/tests/test_routes.py
@@ -0,0 +1,14 @@
+# -*- coding: utf-8 -*-
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+import odoo.tests
+
+
+@odoo.tests.tagged('post_install', '-at_install')
+class TestRoutes(odoo.tests.HttpCase):
+
+    def test_01_web_session_destroy(self):
+        base_url = self.env['ir.config_parameter'].sudo().get_param('web.base.url')
+        self.authenticate('demo', 'demo')
+        res = self.opener.post(url=base_url + '/web/session/destroy', json={})
+        self.assertEqual(res.status_code, 200)