diff --git a/lib/HAPServer.js b/lib/HAPServer.js
index <HASH>..<HASH> 100644
--- a/lib/HAPServer.js
+++ b/lib/HAPServer.js
@@ -652,6 +652,13 @@ HAPServer.prototype._handleCharacteristics = function(request, response, session
     // Extract the query params from the URL which looks like: /characteristics?id=1.9,2.14,...
     var parseQueryString = true;
     var query = url.parse(request.url, parseQueryString).query; // { id: '1.9,2.14' }
+
+    if(query == undefined || query.id == undefined) {
+      response.writeHead(500);
+      response.end();
+      return;
+    }
+
     var sets = query.id.split(','); // ["1.9","2.14"]
     var data = []; // [{aid:1,iid:9},{aid:2,iid:14}]
     
@@ -688,6 +695,13 @@ HAPServer.prototype._handleCharacteristics = function(request, response, session
     }.bind(this));
   }
   else if (request.method == "PUT") {
+
+    // to be safe, prevent doing any change without a secure session
+    if(session.encryption == undefined) {
+      response.writeHead(403);
+      response.end();
+      return;
+    }
     
     // requestData is a JSON payload like { characteristics: [ { aid: 1, iid: 8, value: true, ev: true } ] }
     var data = JSON.parse(requestData.toString()).characteristics; // pull out characteristics array
Prevent modify characteristic without a secure session