The WebSocket handle mount and ViewRuntime. build request rebuild an HttpRequest via RequestFactory().get(...) with no HTTP HOST, so request.get host() defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP path resolved correctly. With STRICT MODE=False the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy).

Fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against ALLOWED HOSTS (the same logic as the CSWSH Origin gate, parsed with Django's split domain port so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly.

No workaround on the live path short of upgrading. Most exposed when combined with STRICT MODE=False.