diff --git a/app/realtime.php b/app/realtime.php
index 9e5486e638..ce2db4450a 100644
--- a/app/realtime.php
+++ b/app/realtime.php
@@ -939,11 +939,21 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
                 $proofForToken = new Token();
                 $proofForToken->setHash(new Sha());
 
-                if (
-                    empty($user->getId()) // Check a document has been found in the DB
-                    || !$user->sessionVerify($store->getProperty('secret', ''), $proofForToken) // Validate user has valid login token
-                ) {
-                    // cookie not valid
+                $sessionSecret = $store->getProperty('secret', '');
+                $userFound = !empty($user->getId());
+                $sessionsInDoc = $userFound ? \count($user->getAttribute('sessions', [])) : 0;
+                $sessionVerified = $userFound && $user->sessionVerify($sessionSecret, $proofForToken);
+
+                if (!$userFound || !$sessionVerified) {
+                    Console::warning(sprintf(
+                        '[realtime-auth-diag] project=%s userId=%s userFound=%s sessions=%d secretPrefix=%s verified=%s',
+                        $projectId ?? '(null)',
+                        $userId,
+                        $userFound ? 'yes' : 'no',
+                        $sessionsInDoc,
+                        \substr($sessionSecret, 0, 8),
+                        $sessionVerified ? 'yes' : 'no'
+                    ));
                     throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Session is not valid.');
                 }