diff --git a/app/realtime.php b/app/realtime.php
index e0591a2596..0239e70f22 100644
--- a/app/realtime.php
+++ b/app/realtime.php
@@ -763,7 +763,7 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
         $database = getConsoleDB();
         $database->setAuthorization($authorization);
 
-        if ($projectId !== 'console') {
+        if (!empty($projectId) && $projectId !== 'console') {
             $project = $authorization->skip(fn () => $database->getDocument('projects', $projectId));
 
             $database = getProjectDB($project);
@@ -795,6 +795,11 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re
             throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Message format is not valid.');
         }
 
+        // Ping does not require project context; other messages do (e.g. after unsubscribe during auth)
+        if (empty($projectId) && ($message['type'] ?? '') !== 'ping') {
+            throw new Exception(Exception::REALTIME_POLICY_VIOLATION, 'Missing project context. Reconnect to the project first.');
+        }
+
         switch ($message['type']) {
             case 'ping':
                 $server->send([$connection], json_encode([