diff --git a/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php b/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
index b7441b9..9bed455 100644
--- a/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
+++ b/core/lib/Drupal/Core/Access/CsrfTokenGenerator.php
@@ -83,7 +83,15 @@ public function setCurrentUser(AccountInterface $current_user = NULL) {
    * @see drupal_session_start()
    */
   public function get($value = '') {
-    return Crypt::hmacBase64($value, session_id() . $this->privateKey->get() . $this->settings->get('hash_salt'));
+    $hash_salt = $this->settings->get('hash_salt');
+
+    // This should never happen, as it breaks user logins and many other services.
+    // Therefore, explicitly notify the user (developer) by throwing an exception.
+    if (empty($hash_salt)) {
+      throw new \RuntimeException('Missing $settings[\'hash_salt\'] in settings.php.');
+    }
+
+    return Crypt::hmacBase64($value, session_id() . $this->privateKey->get() . $hash_salt);
   }
 
   /**
diff --git a/core/tests/Drupal/Tests/Core/Access/CsrfTokenGeneratorTest.php b/core/tests/Drupal/Tests/Core/Access/CsrfTokenGeneratorTest.php
index 26428dc..d6c4e32 100644
--- a/core/tests/Drupal/Tests/Core/Access/CsrfTokenGeneratorTest.php
+++ b/core/tests/Drupal/Tests/Core/Access/CsrfTokenGeneratorTest.php
@@ -24,6 +24,13 @@ class CsrfTokenGeneratorTest extends UnitTestCase {
    */
   protected $generator;
 
+  /**
+   * The mock private key service.
+   *
+   * @var \Drupal\Core\PrivateKey|\PHPUnit_Framework_MockObject_MockObject
+   */
+  protected $privateKey;
+
   public static function getInfo() {
     return array(
       'name' => 'CsrfTokenGenerator test',
@@ -39,16 +46,16 @@ function setUp() {
     parent::setUp();
     $this->key = Crypt::randomBytesBase64(55);
 
-    $private_key = $this->getMockBuilder('Drupal\Core\PrivateKey')
+    $this->privateKey = $this->getMockBuilder('Drupal\Core\PrivateKey')
       ->disableOriginalConstructor()
       ->setMethods(array('get'))
       ->getMock();
 
-    $private_key->expects($this->any())
+    $this->privateKey->expects($this->any())
       ->method('get')
       ->will($this->returnValue($this->key));
 
-    $this->generator = new CsrfTokenGenerator($private_key, new Settings(array('hash_salt' => 'test')));
+    $this->generator = new CsrfTokenGenerator($this->privateKey, new Settings(array('hash_salt' => 'test')));
   }
 
   /**
@@ -61,6 +68,16 @@ public function testGet() {
   }
 
   /**
+   * Tests CsrfTokenGenerator::Get() with no hash salt setting.
+   *
+   * @expectedException \RuntimeException
+   */
+  public function testGetWithNoHashSalt() {
+    $generator = new CsrfTokenGenerator($this->privateKey, new Settings(array()));
+    $generator->get();
+  }
+
+  /**
    * Tests CsrfTokenGenerator::validate().
    */
   public function testValidate() {