diff --git a/core/src/main/java/org/acegisecurity/taglibs/authz/AuthorizeTag.java b/core/src/main/java/org/acegisecurity/taglibs/authz/AuthorizeTag.java
index 87c9b453ae..92d1f304d5 100644
--- a/core/src/main/java/org/acegisecurity/taglibs/authz/AuthorizeTag.java
+++ b/core/src/main/java/org/acegisecurity/taglibs/authz/AuthorizeTag.java
@@ -112,6 +112,10 @@ public class AuthorizeTag extends TagSupport {
 
         Authentication currentUser = context.getAuthentication();
 
+        if (null == currentUser) {
+            return Collections.EMPTY_LIST;
+        }
+
         Collection granted = Arrays.asList(currentUser.getAuthorities());
 
         return granted;
diff --git a/core/src/test/java/org/acegisecurity/taglibs/authz/AuthorizeTagTests.java b/core/src/test/java/org/acegisecurity/taglibs/authz/AuthorizeTagTests.java
index ee77d641aa..ee94db8194 100644
--- a/core/src/test/java/org/acegisecurity/taglibs/authz/AuthorizeTagTests.java
+++ b/core/src/test/java/org/acegisecurity/taglibs/authz/AuthorizeTagTests.java
@@ -42,6 +42,15 @@ public class AuthorizeTagTests extends TestCase {
 
     //~ Methods ================================================================
 
+    public void testAlwaysReturnsUnauthorizedIfNoUserFound()
+        throws JspException {
+        context.setAuthentication(null);
+
+        authorizeTag.setIfAllGranted("ROLE_TELLER");
+        assertEquals("prevents request - no principal in Context",
+            Tag.SKIP_BODY, authorizeTag.doStartTag());
+    }
+
     public void testDefaultsToNotOutputtingBodyWhenNoRequiredAuthorities()
         throws JspException {
         assertEquals("", authorizeTag.getIfAllGranted());