diff --git a/middleware/csrf.go b/middleware/csrf.go
index 3999a92c9..e6359ff4c 100644
--- a/middleware/csrf.go
+++ b/middleware/csrf.go
@@ -256,6 +256,9 @@ func (config CSRFConfig) ToMiddleware() (echo.MiddlewareFunc, error) {
 }
 
 func validateCSRFToken(token, clientToken string) bool {
+	if token == "" || clientToken == "" {
+		return false
+	}
 	return subtle.ConstantTimeCompare([]byte(token), []byte(clientToken)) == 1
 }
 
diff --git a/middleware/csrf_test.go b/middleware/csrf_test.go
index 1a6b18eda..433c14bf2 100644
--- a/middleware/csrf_test.go
+++ b/middleware/csrf_test.go
@@ -278,6 +278,16 @@ func TestCSRFWithConfig(t *testing.T) {
 			expectEmptyBody: true,
 			expectErr:       `code=403, message=invalid csrf token`,
 		},
+		{
+			name: "nok, POST empty cookie token + empty client token is blocked",
+			whenHeaders: map[string]string{
+				echo.HeaderCookie:     "_csrf=",
+				echo.HeaderXCSRFToken: "",
+			},
+			whenMethod:      http.MethodPost,
+			expectEmptyBody: true,
+			expectErr:       `code=403, message=invalid csrf token`,
+		},
 		{
 			name: "nok, invalid trusted origin in Config",
 			givenConfig: &CSRFConfig{