diff --git a/src/applications/auth/storage/PhabricatorAuthChallenge.php b/src/applications/auth/storage/PhabricatorAuthChallenge.php
--- a/src/applications/auth/storage/PhabricatorAuthChallenge.php
+++ b/src/applications/auth/storage/PhabricatorAuthChallenge.php
@@ -56,7 +56,7 @@
     AphrontRequest $request) {
     assert_instances_of($challenges, __CLASS__);
 
-    $token_list = $request->getStr(self::HTTPKEY);
+    $token_list = $request->getStr(self::HTTPKEY, '');
     $token_list = explode(' ', $token_list);
 
     $token_map = array();