It seems that our inherent problem is that both the request and session scopes are unavailable during the processing of a websockets @OnMessage event. See CDI-370 for some more background information.