diff --git a/protocol/xftp.md b/protocol/xftp.md
index 7de6a0fb1..0d3a23ad8 100644
--- a/protocol/xftp.md
+++ b/protocol/xftp.md
@@ -369,8 +369,6 @@ In XFTP v2 the handshake is only used for version negotiation, but `routerCert`
 
 `keyHash` is the CA fingerprint used by client to validate TLS certificate chain and is checked by a router against its own key.
 
-`entitlementProof` is ignored on the web handshake, so a session opened from the browser never gets an entitlement.
-
 `ignoredPart` in handshake allows to add additional parameters in handshake without changing protocol version - the client and routers must ignore any extra bytes within the original block length.
 
 For TLS transport client should assert that `sessionIdentifier` is equal to `tls-unique` channel binding defined in [RFC 5929][14] (TLS Finished message struct); we pass it in `routerHello` block to allow communication over some other transport protocol (possibly, with another channel binding).
diff --git a/src/Simplex/FileTransfer/Server.hs b/src/Simplex/FileTransfer/Server.hs
index ec43ca002..74a6f5ed5 100644
--- a/src/Simplex/FileTransfer/Server.hs
+++ b/src/Simplex/FileTransfer/Server.hs
@@ -185,7 +185,6 @@ xftpServer cfg@XFTPServerConfig {xftpPort, transportConfig, inactiveClientExpira
           | otherwise -> processHello Nothing
         Just (HandshakeSent pk ent_)
           | webHello -> processHello (Just pk)
-          | webHandshake -> processClientHandshake pk (EntChecked Nothing)
           | otherwise -> processClientHandshake pk ent_
         Just (HandshakeAccepted thParams)
           | webHello -> processHello (serverPrivKey <$> thAuth thParams)