diff --git a/backend/src/auth/ws-auth.guard.ts b/backend/src/auth/ws-auth.guard.ts
index 207db60..1f931d3 100644
--- a/backend/src/auth/ws-auth.guard.ts
+++ b/backend/src/auth/ws-auth.guard.ts
@@ -6,9 +6,10 @@ import { WsException } from '@nestjs/websockets';
 export class WsAuthGuard {
   constructor(private jwt: JwtService) {}
 
-  validateClient(client: any): { sub: number; email: string } | null {
+  validateClient(client: any, req?: any): { sub: number; email: string } | null {
     try {
-      const url = new URL(client.url || client._url, 'http://localhost');
+      const rawUrl = req?.url || client.url || client._url;
+      const url = new URL(rawUrl, 'http://localhost');
       const token = url.searchParams.get('token');
       if (!token) throw new WsException('No token');
       return this.jwt.verify(token) as { sub: number; email: string };
diff --git a/backend/src/terminal/sftp.gateway.ts b/backend/src/terminal/sftp.gateway.ts
index 94b892c..7384845 100644
--- a/backend/src/terminal/sftp.gateway.ts
+++ b/backend/src/terminal/sftp.gateway.ts
@@ -16,8 +16,8 @@ export class SftpGateway implements OnGatewayConnection, OnGatewayDisconnect {
     private wsAuth: WsAuthGuard,
   ) {}
 
-  handleConnection(client: any) {
-    const user = this.wsAuth.validateClient(client);
+  handleConnection(client: any, req: any) {
+    const user = this.wsAuth.validateClient(client, req);
     if (!user) {
       client.close(4001, 'Unauthorized');
       return;
diff --git a/backend/src/terminal/terminal.gateway.ts b/backend/src/terminal/terminal.gateway.ts
index 418337f..958d40f 100644
--- a/backend/src/terminal/terminal.gateway.ts
+++ b/backend/src/terminal/terminal.gateway.ts
@@ -15,8 +15,8 @@ export class TerminalGateway implements OnGatewayConnection, OnGatewayDisconnect
     private wsAuth: WsAuthGuard,
   ) {}
 
-  handleConnection(client: any) {
-    const user = this.wsAuth.validateClient(client);
+  handleConnection(client: any, req: any) {
+    const user = this.wsAuth.validateClient(client, req);
     if (!user) {
       client.close(4001, 'Unauthorized');
       return;