Index: lams_tool_chat/src/java/org/lamsfoundation/lams/tool/chat/web/controller/LearningWebsocketServer.java
===================================================================
diff -u -r18a207719c2aa30f683987fd0bb9176521b704de -ra8bbaa43c079c2a25d1a81c234114e6103b046a5
--- lams_tool_chat/src/java/org/lamsfoundation/lams/tool/chat/web/controller/LearningWebsocketServer.java	(.../LearningWebsocketServer.java)	(revision 18a207719c2aa30f683987fd0bb9176521b704de)
+++ lams_tool_chat/src/java/org/lamsfoundation/lams/tool/chat/web/controller/LearningWebsocketServer.java	(.../LearningWebsocketServer.java)	(revision a8bbaa43c079c2a25d1a81c234114e6103b046a5)
@@ -85,7 +85,7 @@
 		try {
 		    // websocket communication bypasses standard HTTP filters, so Hibernate session needs to be initialised manually
 		    HibernateSessionManager.openSession();
-		    
+
 		    Iterator<Entry<Long, Set<Websocket>>> entryIterator = LearningWebsocketServer.websockets.entrySet()
 			    .iterator();
 		    // go throus Tool Session and update registered users with messages and roster
@@ -260,20 +260,26 @@
     public void registerUser(Session session) throws IOException {
 	Long toolSessionId = Long
 		.valueOf(session.getRequestParameterMap().get(AttributeNames.PARAM_TOOL_SESSION_ID).get(0));
+	String userName = session.getUserPrincipal().getName();
+	ChatUser chatUser = LearningWebsocketServer.getChatService().getUserByLoginNameAndSessionId(userName,
+		toolSessionId);
+	if (chatUser == null) {
+	    throw new SecurityException("User \"" + userName
+		    + "\" is not a participant in Chat activity with tool session ID " + toolSessionId);
+	}
+
 	Set<Websocket> sessionWebsockets = LearningWebsocketServer.websockets.get(toolSessionId);
 	if (sessionWebsockets == null) {
 	    sessionWebsockets = ConcurrentHashMap.newKeySet();
 	    LearningWebsocketServer.websockets.put(toolSessionId, sessionWebsockets);
 	}
 	final Set<Websocket> finalSessionWebsockets = sessionWebsockets;
 
-	String userName = session.getUserPrincipal().getName();
 	new Thread(() -> {
 	    try {
 		// websocket communication bypasses standard HTTP filters, so Hibernate session needs to be initialised manually
 		HibernateSessionManager.openSession();
-		ChatUser chatUser = LearningWebsocketServer.getChatService().getUserByLoginNameAndSessionId(userName,
-			toolSessionId);
+
 		Websocket websocket = new Websocket(session, chatUser.getNickname(), chatUser.getUserId(),
 			LearningWebsocketServer.getPortraitId(chatUser.getUserId()));
 		finalSessionWebsockets.add(websocket);