From df56185c6905370619587cedda6b81f2638c2e06 Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Fri, 4 Sep 2026 20:11:48 -0400
Subject: [PATCH 1/2] feat(security): Protect management UI sessions

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
---
 docs/security.md                              |  23 ++
 proto.lock                                    |  20 ++
 .../Components/Pages/Operations.razor         |   4 +
 .../Components/Pages/ScavengeDetail.razor     |   1 +
 .../Components/Pages/SignIn.razor             |  17 +-
 .../Components/Pages/SignOut.razor            |  26 +-
 .../Services/OAuthBrowserFlowEndpoints.cs     |  22 +-
 .../Services/SecurityBrowserService.cs        |  19 +-
 .../Components/Services/UiCredentialCookie.cs | 146 +----------
 .../Services/UiCredentialsMiddleware.cs       |   7 +-
 .../Services/UiSessionAuthentication.cs       | 169 +++++++++++++
 .../Services/UiSessionTicketStore.cs          |  37 +++
 .../Components/Shared/NodeCommandCard.razor   |   1 +
 src/EventStore.ClusterNode/Program.cs         |   1 +
 .../ui-assets/js/admin-operations.js          |   9 +-
 .../ui-assets/js/ui-auth.js                   | 114 +--------
 .../InternalSessionAuthenticationTests.cs     | 200 +++++++++++++++
 .../OAuthBrowserFlowServiceTests.cs           | 160 +++++++++++-
 .../UiSessionIntegrationTests.cs              | 237 ++++++++++++++++++
 .../Authentication/UiSessionSecurityTests.cs  |  31 +++
 .../UiSessionTicketStoreTests.cs              |  24 ++
 .../Forwarding/ForwardingGrpcCodecTests.cs    |  26 ++
 .../Grpc/Forwarding/ForwardingServiceTests.cs |  83 ++++++
 .../CompositeAuthenticationProvider.cs        |  18 +-
 .../DelegatedAuthenticationProvider.cs        |  16 +-
 .../ISessionAuthenticationProvider.cs         |  12 +
 .../InternalAuthenticationProvider.cs         |  91 +++++--
 .../LocalSessionClaimsIdentity.cs             |   6 +
 src/EventStore.Core/ClusterVNodeStartup.cs    |   8 +-
 .../Grpc/Forwarding/ForwardingGrpcCodec.cs    |  23 +-
 .../Grpc/Forwarding/ForwardingService.cs      |  33 +++
 .../Http/AuthenticationMiddleware.cs          |  23 +-
 .../Transport/Http/IUiSessionAuthenticator.cs |  11 +
 src/Protos/Grpc/forwarding.proto              |   6 +
 34 files changed, 1311 insertions(+), 313 deletions(-)
 create mode 100644 src/EventStore.ClusterNode/Components/Services/UiSessionAuthentication.cs
 create mode 100644 src/EventStore.ClusterNode/Components/Services/UiSessionTicketStore.cs
 create mode 100644 src/EventStore.Core.Tests/Authentication/InternalSessionAuthenticationTests.cs
 create mode 100644 src/EventStore.Core.Tests/Authentication/UiSessionIntegrationTests.cs
 create mode 100644 src/EventStore.Core.Tests/Authentication/UiSessionSecurityTests.cs
 create mode 100644 src/EventStore.Core.Tests/Authentication/UiSessionTicketStoreTests.cs
 create mode 100644 src/EventStore.Core/Authentication/ISessionAuthenticationProvider.cs
 create mode 100644 src/EventStore.Core/Authentication/LocalSessionClaimsIdentity.cs
 create mode 100644 src/EventStore.Core/Services/Transport/Http/IUiSessionAuthenticator.cs

diff --git a/docs/security.md b/docs/security.md
index b9eb538865..4518f0fb42 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -527,6 +527,29 @@ making the database authentication method explicit, so password and OAuth access
 Authentication is applied to all HTTP endpoints by default, except `/-/liveness`, `/-/readiness`, static web
 content, and redirects.
 
+### Management UI sessions
+
+Browser sign-in uses ASP.NET Core cookie authentication with a protected session identifier. Passwords are
+used only when signing in; they are not retained in the browser or the session store. OAuth access tokens
+remain in the node's memory and are validated on subsequent requests. Sessions expire after 15 minutes
+without automatic renewal. Signing out revokes the server-side ticket, including copies of its cookie.
+Existing credential cookies are discarded and require a new sign-in after upgrading.
+
+Browser sign-in requires HTTPS to the node, including when an ingress or reverse proxy terminates public
+TLS. Configure TLS on the upstream connection as well. `DisableTls` does not enable browser sessions over
+HTTP. Session cookies are Secure, HttpOnly, host-only, and SameSite=Lax. Cookie authentication is limited
+to `/ui`; gRPC clients continue to supply their own credentials. UI mutations require antiforgery tokens.
+
+Sessions are held in a bounded, node-local memory store. A node restart, store eviction, or connection to
+a different node requires signing in again. Use a node-specific management address or session affinity
+at the ingress. Sharing Data Protection keys alone does not share the session store.
+
+Each password session is checked against the latest local user record on every request. Password changes,
+role changes, disabling, or deleting the account invalidate its previous sessions as those changes replicate
+to each node. A node that cannot validate the account rejects the session. Forwarded writes are revalidated
+by the leader over the authenticated TLS connection between nodes. During a rolling upgrade, use the
+leader's UI for writes until all nodes support session forwarding.
+
 ### Authentication methods
 
 Use `Auth:Methods` to choose the authentication methods enabled by the node. If `Auth:Methods` is not set, the
diff --git a/proto.lock b/proto.lock
index f01a43a1fa..068485f54f 100644
--- a/proto.lock
+++ b/proto.lock
@@ -2343,6 +2343,26 @@
                 "id": 4,
                 "name": "anonymous",
                 "type": "google.protobuf.Empty"
+              },
+              {
+                "id": 5,
+                "name": "local_session",
+                "type": "LocalSession"
+              }
+            ]
+          },
+          {
+            "name": "LocalSession",
+            "fields": [
+              {
+                "id": 1,
+                "name": "username",
+                "type": "string"
+              },
+              {
+                "id": 2,
+                "name": "user_event_id",
+                "type": "event_store.client.UUID"
               }
             ]
           },
diff --git a/src/EventStore.ClusterNode/Components/Pages/Operations.razor b/src/EventStore.ClusterNode/Components/Pages/Operations.razor
index 0c22341f3c..7f6fadbdbb 100644
--- a/src/EventStore.ClusterNode/Components/Pages/Operations.razor
+++ b/src/EventStore.ClusterNode/Components/Pages/Operations.razor
@@ -85,6 +85,7 @@ else
 			}
 
 			<form class="mt-5 grid gap-4 rounded-[1.5rem] border border-es-ink/10 bg-white/70 p-5 md:grid-cols-5" method="post" action="/ui/operations/scavenge/start" data-admin-command data-confirm="Start a database scavenge?">
+				<Microsoft.AspNetCore.Components.Forms.AntiforgeryToken />
 				<label class="text-sm font-bold text-es-muted">
 					Start chunk
 					<input class="mt-2 w-full rounded-2xl border border-es-ink/10 bg-white px-3 py-2 text-es-ink outline-none focus:border-es-green focus:ring-4 focus:ring-es-green/15" name="startFromChunk" type="number" min="0" value="0" disabled="@(!Page.Scavenge.SupportsScavenge)" />
@@ -162,6 +163,7 @@ else
 											@if (item.CanStop)
 											{
 												<form method="post" action="/ui/operations/scavenge/stop" data-admin-command data-confirm="Stop this scavenge?">
+													<Microsoft.AspNetCore.Components.Forms.AntiforgeryToken />
 													<input name="scavengeId" type="hidden" value="@item.ScavengeId" />
 													<button class="rounded-full border border-red-200 bg-red-50 px-3 py-1.5 text-xs font-black text-red-800 transition hover:bg-red-100" type="submit">Stop</button>
 												</form>
@@ -190,6 +192,7 @@ else
 			<p class="text-sm font-black uppercase tracking-[0.22em] text-es-green">Node priority</p>
 			<p class="mt-3 text-sm leading-6 text-es-muted">Adjust election priority deliberately during operations work.</p>
 			<form class="mt-5 flex gap-2" method="post" action="/ui/operations/set-priority" data-admin-command data-confirm="Set node priority?">
+				<Microsoft.AspNetCore.Components.Forms.AntiforgeryToken />
 				<input class="min-w-0 flex-1 rounded-2xl border border-es-ink/10 bg-white px-3 py-2 text-es-ink outline-none focus:border-es-green focus:ring-4 focus:ring-es-green/15" name="priority" type="number" value="0" />
 				<button class="rounded-2xl bg-es-ink px-4 py-2 text-sm font-black text-white transition hover:bg-es-green" type="submit">Set</button>
 			</form>
@@ -204,6 +207,7 @@ else
 				<p class="mt-3 max-w-3xl text-sm leading-6">This requests process shutdown and should only be used when the operator intends to stop the node.</p>
 			</div>
 			<form method="post" action="/ui/operations/shutdown" data-admin-command data-admin-no-refresh="true" data-confirm="Shutdown this node?">
+				<Microsoft.AspNetCore.Components.Forms.AntiforgeryToken />
 				<button class="rounded-2xl bg-red-700 px-5 py-3 text-sm font-black text-white shadow-lg shadow-red-900/15 transition hover:bg-red-800" type="submit">Shutdown</button>
 			</form>
 		</div>
diff --git a/src/EventStore.ClusterNode/Components/Pages/ScavengeDetail.razor b/src/EventStore.ClusterNode/Components/Pages/ScavengeDetail.razor
index 1450784e2a..ded0fb10ac 100644
--- a/src/EventStore.ClusterNode/Components/Pages/ScavengeDetail.razor
+++ b/src/EventStore.ClusterNode/Components/Pages/ScavengeDetail.razor
@@ -50,6 +50,7 @@ else
 			@if (Page.CanStop)
 			{
 				<form method="post" action="/ui/operations/scavenge/stop" data-admin-command data-confirm="Stop this scavenge?">
+					<Microsoft.AspNetCore.Components.Forms.AntiforgeryToken />
 					<input name="scavengeId" type="hidden" value="@Page.ScavengeId" />
 					<button class="rounded-2xl border border-red-200 bg-red-50 px-4 py-2 text-sm font-black text-red-800 transition hover:bg-red-100" type="submit">Stop scavenge</button>
 				</form>
diff --git a/src/EventStore.ClusterNode/Components/Pages/SignIn.razor b/src/EventStore.ClusterNode/Components/Pages/SignIn.razor
index 0fde6b1b1f..e0eca1cc97 100644
--- a/src/EventStore.ClusterNode/Components/Pages/SignIn.razor
+++ b/src/EventStore.ClusterNode/Components/Pages/SignIn.razor
@@ -160,22 +160,19 @@
 
 	private async Task SignInUser() {
 		try {
-			var result = await Security.Validate(Input.Username, Input.Password);
-			if (!result.Success) {
-				DisplayedOAuthError = "";
-				Message = result.Message;
-				return;
-			}
-
 			var context = HttpContextAccessor.HttpContext;
 			if (context is null) {
-				DisplayedOAuthError = "";
 				Message = "The sign-in response is no longer available.";
 				return;
 			}
+			var result = await Security.SignInAsync(context, Input.Username, Input.Password);
+			Input.Password = "";
+			if (!result.Success) {
+				DisplayedOAuthError = "";
+				Message = result.Message;
+				return;
+			}
 
-			UiCredentialCookie.DeleteOAuthToken(context.Response);
-			UiCredentialCookie.AppendBasic(context.Response, new UiCredentials(Input.Username.Trim(), Input.Password));
 		} catch (OperationCanceledException) {
 			DisplayedOAuthError = "";
 			Message = "Sign-in was canceled.";
diff --git a/src/EventStore.ClusterNode/Components/Pages/SignOut.razor b/src/EventStore.ClusterNode/Components/Pages/SignOut.razor
index 8c47f1df8a..f84541552a 100644
--- a/src/EventStore.ClusterNode/Components/Pages/SignOut.razor
+++ b/src/EventStore.ClusterNode/Components/Pages/SignOut.razor
@@ -1,13 +1,20 @@
 @page "/ui/signout"
 @layout AuthLayout
 @inject IHttpContextAccessor HttpContextAccessor
+@using Microsoft.AspNetCore.Authentication
+@using Microsoft.AspNetCore.Components.Forms
 
-<PageTitle>Signed out - EventStore UI</PageTitle>
+<PageTitle>Sign out - EventStore UI</PageTitle>
 
-<section class="w-full max-w-2xl rounded-[2rem] border border-white/80 bg-white/95 p-8 text-center shadow-[0_24px_90px_rgba(23,32,51,0.12)] backdrop-blur" data-ui-clear-auth>
-	<p class="text-xs font-black uppercase tracking-[0.28em] text-es-green">Session cleared</p>
-	<h1 class="mt-4 text-5xl font-black tracking-tight text-es-ink sm:text-6xl">You have been signed out.</h1>
-	<p class="mt-5 text-lg leading-8 text-es-muted">Stored browser credentials for the management UI have been removed.</p>
+<section class="w-full max-w-2xl rounded-[2rem] border border-white/80 bg-white/95 p-8 text-center shadow-[0_24px_90px_rgba(23,32,51,0.12)] backdrop-blur">
+	<h1 class="text-5xl font-black tracking-tight text-es-ink sm:text-6xl">@(SignedOut ? "You have been signed out." : "Sign out of this node?")</h1>
+	<p class="mt-5 text-lg leading-8 text-es-muted">@(SignedOut ? "Your management session has been revoked." : "This ends your current management session.")</p>
+	@if (!SignedOut) {
+		<form method="post" @formname="signout" @onsubmit="SignOutUser">
+			<AntiforgeryToken />
+			<button type="submit" class="rounded-2xl bg-es-ink px-5 py-3 font-black text-white">Sign out</button>
+		</form>
+	}
 	<div class="mt-7 flex flex-wrap justify-center gap-2">
 		<a class="rounded-2xl bg-es-ink px-5 py-3 text-sm font-black text-white shadow-lg shadow-es-ink/15 transition hover:bg-es-green" href="/ui/signin">Sign in again</a>
 		<a class="rounded-2xl border border-es-ink/10 bg-white px-5 py-3 text-sm font-black text-es-ink transition hover:border-es-green/30 hover:text-es-forest" href="/ui">Return to UI</a>
@@ -15,12 +22,15 @@
 </section>
 
 @code {
-	protected override void OnInitialized() {
+	private bool SignedOut;
+
+	private async Task SignOutUser() {
 		var context = HttpContextAccessor.HttpContext;
 		if (context is null)
 			return;
 
-		UiCredentialCookie.Delete(context.Response);
-		UiCredentialCookie.DeleteOAuthToken(context.Response);
+		await context.SignOutAsync(UiSessionAuthentication.Scheme);
+		UiCredentialCookie.DeleteLegacyCookies(context.Response);
+		SignedOut = true;
 	}
 }
diff --git a/src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs b/src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs
index aa990d6630..cef739ed23 100644
--- a/src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs
+++ b/src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs
@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Net.Http;
+using System.Security.Claims;
 using System.Security.Cryptography;
 using System.Text;
 using System.Text.Json;
@@ -10,10 +11,12 @@
 using System.Threading.Tasks;
 using EventStore.Core;
 using EventStore.Core.Authentication.OAuth;
+using EventStore.Plugins.Authentication;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
 
 namespace EventStore.ClusterNode.Components.Services;
 
@@ -64,6 +67,8 @@ public OAuthCodeChallenge CreateCodeChallenge(HttpContext context)
 
 	public async Task<IResult> HandleCallback(HttpContext context, CancellationToken cancellationToken)
 	{
+		if (!context.Request.IsHttps)
+			return ErrorRedirect("https_required", "");
 		var code = context.Request.Query["code"].ToString();
 		var state = context.Request.Query["state"].ToString();
 		var providerError = context.Request.Query["error"].ToString();
@@ -115,8 +120,21 @@ public async Task<IResult> HandleCallback(HttpContext context, CancellationToken
 			return ErrorRedirect("invalid_token", returnUrl);
 		}
 
-		UiCredentialCookie.Delete(context.Response);
-		UiCredentialCookie.AppendOAuthToken(context.Response, token);
+		var request = new HttpAuthenticationRequest(context, token);
+		context.RequestServices.GetRequiredService<IAuthenticationProvider>().Authenticate(request);
+		HttpAuthenticationRequestStatus status;
+		ClaimsPrincipal principal;
+		try
+		{
+			(status, principal) = await request.AuthenticateAsync().WaitAsync(TimeSpan.FromSeconds(5), cancellationToken);
+		}
+		catch (TimeoutException)
+		{
+			return ErrorRedirect("invalid_token", returnUrl);
+		}
+		if (status != HttpAuthenticationRequestStatus.Authenticated)
+			return ErrorRedirect("invalid_token", returnUrl);
+		await UiSessionAuthentication.SignInAsync(context, principal, token);
 		return Results.Redirect(adminUiEnabled ? SignInLocation(returnUrl) : DirectReturnLocation(returnUrl));
 	}
 
diff --git a/src/EventStore.ClusterNode/Components/Services/SecurityBrowserService.cs b/src/EventStore.ClusterNode/Components/Services/SecurityBrowserService.cs
index 1e4e6b7f9c..cae991f1d3 100644
--- a/src/EventStore.ClusterNode/Components/Services/SecurityBrowserService.cs
+++ b/src/EventStore.ClusterNode/Components/Services/SecurityBrowserService.cs
@@ -4,6 +4,7 @@
 using System.Security.Claims;
 using System.Text.Json;
 using System.Threading.Tasks;
+using EventStore.Core.Authentication;
 using EventStore.Plugins.Authentication;
 using Microsoft.AspNetCore.Http;
 
@@ -37,8 +38,12 @@ public SecurityAuthenticationInfo AuthenticationInfo()
 			properties);
 	}
 
-	public async Task<SecurityCommandResult> Validate(string username, string password)
+	public async Task<SecurityCommandResult> SignInAsync(HttpContext context, string username, string password)
 	{
+		if (!supportsPassword || authenticationProvider is not ISessionAuthenticationProvider sessions)
+			return SecurityCommandResult.Failure("Password browser sign-in is not available.");
+		if (!context.Request.IsHttps)
+			return SecurityCommandResult.Failure("Browser sign-in requires HTTPS.");
 		if (string.IsNullOrWhiteSpace(username))
 		{
 			return SecurityCommandResult.Failure("Enter a username.");
@@ -49,10 +54,16 @@ public async Task<SecurityCommandResult> Validate(string username, string passwo
 			return SecurityCommandResult.Failure("Enter a password.");
 		}
 
-		var context = new DefaultHttpContext();
 		var request = new HttpAuthenticationRequest(context, username.Trim(), password);
-		authenticationProvider.Authenticate(request);
-		var (status, _) = await request.AuthenticateAsync();
+		sessions.AuthenticateSession(request);
+		var (status, principal) = await request.AuthenticateAsync().WaitAsync(TimeSpan.FromSeconds(5), context.RequestAborted);
+		if (status == HttpAuthenticationRequestStatus.Authenticated)
+		{
+			var current = await sessions.ValidateSessionAsync(principal, context.RequestAborted);
+			if (current is null)
+				return SecurityCommandResult.Failure("The account changed during sign-in. Try again.");
+			await UiSessionAuthentication.SignInAsync(context, current);
+		}
 
 		return status switch
 		{
diff --git a/src/EventStore.ClusterNode/Components/Services/UiCredentialCookie.cs b/src/EventStore.ClusterNode/Components/Services/UiCredentialCookie.cs
index 2edcc93b8a..b107455110 100644
--- a/src/EventStore.ClusterNode/Components/Services/UiCredentialCookie.cs
+++ b/src/EventStore.ClusterNode/Components/Services/UiCredentialCookie.cs
@@ -1,154 +1,16 @@
-using System;
-using System.Linq;
-using System.Text;
-using System.Text.Json;
 using Microsoft.AspNetCore.Http;
 
 namespace EventStore.ClusterNode.Components.Services;
 
-public sealed record UiCredentials(string Username, string Password)
-{
-	public string BasicValue => Convert.ToBase64String(Encoding.UTF8.GetBytes($"{Username}:{Password}"));
-}
-
 public static class UiCredentialCookie
 {
 	public const string BasicCookieName = "es-creds";
 	public const string OAuthCookieName = "oauth_token";
 
-	public static void AppendBasic(HttpResponse response, UiCredentials credentials) =>
-		AppendBasicValue(response, credentials.BasicValue);
-
-	public static void AppendOAuthToken(HttpResponse response, string token) =>
-		response.Cookies.Append(
-			OAuthCookieName,
-			token,
-			Options(response.HttpContext.Request.IsHttps));
-
-	private static void AppendBasicValue(HttpResponse response, string value) =>
-		response.Cookies.Append(
-			BasicCookieName,
-			JsonSerializer.Serialize(new { credentials = value }),
-			Options(response.HttpContext.Request.IsHttps));
-
-	public static void Delete(HttpResponse response) =>
-		response.Cookies.Delete(BasicCookieName, Options(response.HttpContext.Request.IsHttps));
-
-	public static void DeleteOAuthToken(HttpResponse response) =>
-		response.Cookies.Delete(OAuthCookieName, Options(response.HttpContext.Request.IsHttps));
-
-	public static bool TryReadAuthorization(HttpRequest request, out string scheme, out string value)
-	{
-		if (TryReadBearer(request, out value))
-		{
-			scheme = "Bearer";
-			return true;
-		}
-
-		if (TryReadBasic(request, out value))
-		{
-			scheme = "Basic";
-			return true;
-		}
-
-		scheme = "";
-		value = "";
-		return false;
-	}
-
-	private static bool TryReadBearer(HttpRequest request, out string value)
-	{
-		value = "";
-		if (!request.Cookies.TryGetValue(OAuthCookieName, out var token) || string.IsNullOrWhiteSpace(token))
-		{
-			return false;
-		}
-
-		value = SafeDecode(token);
-		return IsHeaderSafe(value);
-	}
-
-	private static bool TryReadBasic(HttpRequest request, out string value)
+	public static void DeleteLegacyCookies(HttpResponse response)
 	{
-		value = "";
-		if (!request.Cookies.TryGetValue(BasicCookieName, out var raw) || string.IsNullOrWhiteSpace(raw))
-		{
-			return false;
-		}
-
-		if (!TryExtractBasicValue(SafeDecode(raw), out value))
-		{
-			return false;
-		}
-
-		return IsHeaderSafe(value) && TryDecodeBasicValue(value, out _, out _);
+		var options = new CookieOptions { HttpOnly = true, Path = "/", SameSite = SameSiteMode.Lax, Secure = response.HttpContext.Request.IsHttps };
+		response.Cookies.Delete(BasicCookieName, options);
+		response.Cookies.Delete(OAuthCookieName, options);
 	}
-
-	private static bool TryExtractBasicValue(string raw, out string value)
-	{
-		value = "";
-
-		try
-		{
-			using var document = JsonDocument.Parse(raw);
-			if (!document.RootElement.TryGetProperty("credentials", out var credentials))
-			{
-				return false;
-			}
-
-			value = credentials.GetString() ?? "";
-			return !string.IsNullOrWhiteSpace(value);
-		}
-		catch (JsonException)
-		{
-			return false;
-		}
-	}
-
-	private static bool TryDecodeBasicValue(string value, out string username, out string password)
-	{
-		username = "";
-		password = "";
-		try
-		{
-			var decoded = Encoding.UTF8.GetString(Convert.FromBase64String(value));
-			var separator = decoded.IndexOf(':', StringComparison.Ordinal);
-			if (separator < 0)
-			{
-				return false;
-			}
-
-			username = decoded[..separator];
-			password = decoded[(separator + 1)..];
-			return true;
-		}
-		catch (FormatException)
-		{
-			return false;
-		}
-	}
-
-	private static bool IsHeaderSafe(string value) =>
-		!value.Any(x => x is '\r' or '\n');
-
-	private static string SafeDecode(string value)
-	{
-		try
-		{
-			return Uri.UnescapeDataString(value);
-		}
-		catch (UriFormatException)
-		{
-			return value;
-		}
-	}
-
-	private static CookieOptions Options(bool secure) => new()
-	{
-		HttpOnly = true,
-		IsEssential = true,
-		Path = "/",
-		SameSite = SameSiteMode.Lax,
-		Secure = secure
-	};
 }
diff --git a/src/EventStore.ClusterNode/Components/Services/UiCredentialsMiddleware.cs b/src/EventStore.ClusterNode/Components/Services/UiCredentialsMiddleware.cs
index 22249bc5d9..900a43d655 100644
--- a/src/EventStore.ClusterNode/Components/Services/UiCredentialsMiddleware.cs
+++ b/src/EventStore.ClusterNode/Components/Services/UiCredentialsMiddleware.cs
@@ -1,6 +1,5 @@
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Http;
-using Microsoft.Net.Http.Headers;
 
 namespace EventStore.ClusterNode.Components.Services;
 
@@ -8,10 +7,10 @@ public sealed class UiCredentialsMiddleware(RequestDelegate next)
 {
 	public Task InvokeAsync(HttpContext context)
 	{
-		if (!context.Request.Headers.ContainsKey(HeaderNames.Authorization) &&
-			UiCredentialCookie.TryReadAuthorization(context.Request, out var scheme, out var value))
+		if (context.Request.Cookies.ContainsKey(UiCredentialCookie.BasicCookieName) ||
+			context.Request.Cookies.ContainsKey(UiCredentialCookie.OAuthCookieName))
 		{
-			context.Request.Headers.Authorization = $"{scheme} {value}";
+			UiCredentialCookie.DeleteLegacyCookies(context.Response);
 		}
 
 		return next(context);
diff --git a/src/EventStore.ClusterNode/Components/Services/UiSessionAuthentication.cs b/src/EventStore.ClusterNode/Components/Services/UiSessionAuthentication.cs
new file mode 100644
index 0000000000..5dfeb1cd52
--- /dev/null
+++ b/src/EventStore.ClusterNode/Components/Services/UiSessionAuthentication.cs
@@ -0,0 +1,169 @@
+using System;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using EventStore.Core.Authentication;
+using EventStore.Core.Services.Transport.Http;
+using EventStore.Plugins.Authentication;
+using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Options;
+
+namespace EventStore.ClusterNode.Components.Services;
+
+public static class UiSessionAuthentication
+{
+	public const string Scheme = "EventStoreUiSession";
+	public const string CookieName = "__Host-eventstore-ui-session";
+	public const string SessionIdClaim = "eventstore:ui-session-id";
+	internal const string OAuthTokenProperty = "ui.oauth-token";
+	public static readonly TimeSpan Lifetime = TimeSpan.FromMinutes(15);
+
+	public static IServiceCollection AddUiSessionAuthentication(this IServiceCollection services)
+	{
+		services.AddSingleton<UiSessionTicketStore>();
+		services.AddSingleton<IUiSessionAuthenticator, UiSessionAuthenticator>();
+		services.AddScoped<UiSessionEvents>();
+		services.AddAuthentication().AddCookie(Scheme, options =>
+		{
+			options.Cookie.Name = CookieName;
+			options.Cookie.Path = "/";
+			options.Cookie.HttpOnly = true;
+			options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+			options.Cookie.SameSite = SameSiteMode.Lax;
+			options.ExpireTimeSpan = Lifetime;
+			options.SlidingExpiration = false;
+			options.EventsType = typeof(UiSessionEvents);
+		});
+		return services;
+	}
+
+	public static async Task SignInAsync(HttpContext context, ClaimsPrincipal principal, string oauthToken = null)
+	{
+		if (!context.Request.IsHttps)
+			throw new InvalidOperationException("Browser sign-in requires HTTPS.");
+		if (principal?.Identity?.IsAuthenticated != true)
+			throw new InvalidOperationException("An authenticated identity is required.");
+
+		await context.SignOutAsync(Scheme);
+		var options = context.RequestServices.GetRequiredService<IOptionsMonitor<CookieAuthenticationOptions>>().Get(Scheme);
+		var issued = (options.TimeProvider ?? TimeProvider.System).GetUtcNow();
+		var properties = new AuthenticationProperties
+		{
+			IsPersistent = false,
+			AllowRefresh = false,
+			IssuedUtc = issued,
+			ExpiresUtc = issued.Add(Lifetime)
+		};
+		if (oauthToken is not null)
+			properties.Items[OAuthTokenProperty] = oauthToken;
+		var store = context.RequestServices.GetRequiredService<UiSessionTicketStore>();
+		var id = await store.StoreAsync(new AuthenticationTicket(principal, properties, Scheme));
+		UiCredentialCookie.DeleteLegacyCookies(context.Response);
+		try
+		{
+			await context.SignInAsync(Scheme,
+				new ClaimsPrincipal(new ClaimsIdentity([new Claim(SessionIdClaim, id)], Scheme)),
+				new AuthenticationProperties
+				{
+					IsPersistent = false,
+					AllowRefresh = false,
+					IssuedUtc = issued,
+					ExpiresUtc = issued.Add(Lifetime)
+				});
+		}
+		catch
+		{
+			await store.RemoveAsync(id);
+			throw;
+		}
+	}
+}
+
+public sealed class UiSessionAuthenticator : IUiSessionAuthenticator
+{
+	public async Task<bool> ValidateRequestAsync(HttpContext context)
+	{
+		if (HttpMethods.IsGet(context.Request.Method) || HttpMethods.IsHead(context.Request.Method) ||
+			HttpMethods.IsOptions(context.Request.Method))
+			return true;
+		try
+		{
+			await context.RequestServices.GetRequiredService<IAntiforgery>().ValidateRequestAsync(context);
+			return true;
+		}
+		catch (AntiforgeryValidationException)
+		{
+			return false;
+		}
+	}
+
+	public async Task<ClaimsPrincipal> AuthenticateAsync(HttpContext context)
+	{
+		if (!context.Request.IsHttps)
+			return null;
+		var result = await context.AuthenticateAsync(UiSessionAuthentication.Scheme);
+		return result.Succeeded ? result.Principal : null;
+	}
+}
+
+public sealed class UiSessionEvents(IAuthenticationProvider authenticationProvider, UiSessionTicketStore store) : CookieAuthenticationEvents
+{
+	public override async Task ValidatePrincipal(CookieValidatePrincipalContext context)
+	{
+		var id = context.Principal?.FindFirst(UiSessionAuthentication.SessionIdClaim)?.Value;
+		var ticket = string.IsNullOrEmpty(id) ? null : await store.RetrieveAsync(id);
+		ClaimsPrincipal principal = null;
+		if (ticket is not null && ticket.Properties.Items.TryGetValue(UiSessionAuthentication.OAuthTokenProperty, out var token))
+		{
+			var request = new HttpAuthenticationRequest(context.HttpContext, token);
+			authenticationProvider.Authenticate(request);
+			try
+			{
+				var (status, authenticated) = await request.AuthenticateAsync().WaitAsync(
+					TimeSpan.FromSeconds(5), context.HttpContext.RequestAborted);
+				if (status == HttpAuthenticationRequestStatus.Authenticated)
+					principal = authenticated;
+			}
+			catch (TimeoutException)
+			{
+				principal = null;
+			}
+		}
+		else if (ticket is not null && authenticationProvider is ISessionAuthenticationProvider sessions)
+		{
+			principal = await sessions.ValidateSessionAsync(ticket.Principal, context.HttpContext.RequestAborted);
+		}
+
+		if (principal?.Identity?.IsAuthenticated != true)
+		{
+			context.RejectPrincipal();
+			await context.HttpContext.SignOutAsync(UiSessionAuthentication.Scheme);
+			return;
+		}
+		context.ReplacePrincipal(principal);
+	}
+
+	public override async Task SigningOut(CookieSigningOutContext context)
+	{
+		var cookie = context.Options.CookieManager.GetRequestCookie(context.HttpContext, context.Options.Cookie.Name);
+		var ticket = string.IsNullOrEmpty(cookie) ? null : context.Options.TicketDataFormat.Unprotect(cookie);
+		var id = ticket?.Principal.FindFirst(UiSessionAuthentication.SessionIdClaim)?.Value;
+		if (!string.IsNullOrEmpty(id))
+			await store.RemoveAsync(id);
+	}
+
+	public override Task RedirectToLogin(RedirectContext<CookieAuthenticationOptions> context)
+	{
+		context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+		return Task.CompletedTask;
+	}
+
+	public override Task RedirectToAccessDenied(RedirectContext<CookieAuthenticationOptions> context)
+	{
+		context.Response.StatusCode = StatusCodes.Status403Forbidden;
+		return Task.CompletedTask;
+	}
+}
diff --git a/src/EventStore.ClusterNode/Components/Services/UiSessionTicketStore.cs b/src/EventStore.ClusterNode/Components/Services/UiSessionTicketStore.cs
new file mode 100644
index 0000000000..4413d4b9cd
--- /dev/null
+++ b/src/EventStore.ClusterNode/Components/Services/UiSessionTicketStore.cs
@@ -0,0 +1,37 @@
+using System;
+using System.Security.Cryptography;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.Extensions.Caching.Memory;
+
+namespace EventStore.ClusterNode.Components.Services;
+
+public sealed class UiSessionTicketStore : IDisposable
+{
+	private readonly MemoryCache _tickets = new(new MemoryCacheOptions { SizeLimit = 10_000 });
+
+	public Task<string> StoreAsync(AuthenticationTicket ticket)
+	{
+		var key = Convert.ToHexString(RandomNumberGenerator.GetBytes(32));
+		if (ticket.Properties.ExpiresUtc is not { } expires)
+			throw new InvalidOperationException("UI sessions require an absolute expiration.");
+		_tickets.Set(key, TicketSerializer.Default.Serialize(ticket),
+			new MemoryCacheEntryOptions { AbsoluteExpiration = expires, Size = 1 });
+		if (!_tickets.TryGetValue(key, out _))
+			throw new InvalidOperationException("The node cannot accept another management session. Try again later.");
+		return Task.FromResult(key);
+	}
+
+	public Task<AuthenticationTicket> RetrieveAsync(string key) =>
+		Task.FromResult(_tickets.TryGetValue(key, out byte[] ticket)
+			? TicketSerializer.Default.Deserialize(ticket)
+			: null);
+
+	public Task RemoveAsync(string key)
+	{
+		_tickets.Remove(key);
+		return Task.CompletedTask;
+	}
+
+	public void Dispose() => _tickets.Dispose();
+}
diff --git a/src/EventStore.ClusterNode/Components/Shared/NodeCommandCard.razor b/src/EventStore.ClusterNode/Components/Shared/NodeCommandCard.razor
index e0072b0173..87c25d4055 100644
--- a/src/EventStore.ClusterNode/Components/Shared/NodeCommandCard.razor
+++ b/src/EventStore.ClusterNode/Components/Shared/NodeCommandCard.razor
@@ -3,6 +3,7 @@
 	<h2 class="mt-3 text-xl font-black tracking-tight text-es-ink">@Title</h2>
 	<p class="mt-3 text-sm leading-6 text-es-muted">@Description</p>
 	<form class="mt-5" method="post" action="@Action" data-admin-command data-confirm="@Confirm">
+		<Microsoft.AspNetCore.Components.Forms.AntiforgeryToken />
 		<button class="rounded-2xl bg-es-ink px-5 py-3 text-sm font-black text-white shadow-lg shadow-es-ink/15 transition hover:bg-es-green" type="submit">@ButtonText</button>
 	</form>
 </article>
diff --git a/src/EventStore.ClusterNode/Program.cs b/src/EventStore.ClusterNode/Program.cs
index 695c0c7c3a..72581cb202 100644
--- a/src/EventStore.ClusterNode/Program.cs
+++ b/src/EventStore.ClusterNode/Program.cs
@@ -294,6 +294,7 @@ async Task Run(ClusterVNodeHostedService hostedService, ManualResetEventSlim sig
 					hostedService.Node.Startup.ConfigureServicesOnly(builder.Services);
 					builder.Services.AddHttpContextAccessor();
 					builder.Services.AddDataProtection();
+					builder.Services.AddUiSessionAuthentication();
 					builder.Services.AddRazorComponents();
 					builder.Services.AddScoped<ProjectionBrowserService>();
 					builder.Services.AddSingleton<QueueDashboardService>();
diff --git a/src/EventStore.ClusterNode/ui-assets/js/admin-operations.js b/src/EventStore.ClusterNode/ui-assets/js/admin-operations.js
index 0e4d47af8a..6d8af34ff5 100644
--- a/src/EventStore.ClusterNode/ui-assets/js/admin-operations.js
+++ b/src/EventStore.ClusterNode/ui-assets/js/admin-operations.js
@@ -8,7 +8,7 @@
 		var payload = {};
 		var data = new FormData(form);
 		data.forEach(function (value, key) {
-			if (value === "")
+			if (value === "" || key === "__RequestVerificationToken")
 				return;
 
 			if (isNumberField(form, key)) {
@@ -73,13 +73,18 @@
 
 		commandInFlight += 1;
 		try {
+			var antiforgery = form.querySelector('input[name="__RequestVerificationToken"]');
+			if (!antiforgery || !antiforgery.value)
+				throw new Error("The security token is missing. Reload the page before trying again.");
+
 			showStatus(form, "Command in progress...", true);
 			var response = await fetch(form.action, {
 				method: "POST",
 				credentials: "same-origin",
 				headers: {
 					"Accept": "application/json",
-					"Content-Type": "application/json"
+					"Content-Type": "application/json",
+					"RequestVerificationToken": antiforgery.value
 				},
 				body: JSON.stringify(readForm(form))
 			});
diff --git a/src/EventStore.ClusterNode/ui-assets/js/ui-auth.js b/src/EventStore.ClusterNode/ui-assets/js/ui-auth.js
index bcf21f35a9..49ec2b0c91 100644
--- a/src/EventStore.ClusterNode/ui-assets/js/ui-auth.js
+++ b/src/EventStore.ClusterNode/ui-assets/js/ui-auth.js
@@ -1,89 +1,6 @@
 (function () {
 	"use strict";
 
-	var originalFetch = window.fetch;
-
-	function readCookie(name) {
-		var prefix = name + "=";
-		var parts = document.cookie ? document.cookie.split(";") : [];
-		for (var i = 0; i < parts.length; i++) {
-			var part = parts[i].trim();
-			if (part.indexOf(prefix) !== 0)
-				continue;
-
-			return part.substring(prefix.length);
-		}
-
-		return "";
-	}
-
-	function safeDecode(value) {
-		try {
-			return decodeURIComponent(value);
-		} catch (_) {
-			return value;
-		}
-	}
-
-	function isHeaderSafe(value) {
-		return value && !/[\r\n]/.test(value);
-	}
-
-	function readAuthorization() {
-		var token = safeDecode(readCookie("oauth_token"));
-		if (isHeaderSafe(token))
-			return "Bearer " + token;
-
-		var raw = safeDecode(readCookie("es-creds"));
-		if (!raw)
-			return "";
-
-		try {
-			var parsed = JSON.parse(raw);
-			var credentials = parsed && typeof parsed.credentials === "string" ? parsed.credentials : "";
-			if (!isHeaderSafe(credentials))
-				return "";
-
-			return "Basic " + credentials;
-		} catch (_) {
-			return "";
-		}
-	}
-
-	function sameOrigin(input) {
-		var url = new URL(input instanceof Request ? input.url : input, window.location.href);
-		return url.origin === window.location.origin;
-	}
-
-	function addAuthorization(input, init) {
-		var authorization = readAuthorization();
-		if (!authorization || !sameOrigin(input))
-			return init;
-
-		var options = init ? Object.assign({}, init) : {};
-		var headers = new Headers(options.headers || (input instanceof Request ? input.headers : undefined));
-		if (!headers.has("Authorization"))
-			headers.set("Authorization", authorization);
-		options.headers = headers;
-		return options;
-	}
-
-	if (originalFetch) {
-		window.fetch = function (input, init) {
-			return originalFetch(input, addAuthorization(input, init));
-		};
-	}
-
-	function clearCookie(name) {
-		var secure = window.location.protocol === "https:" ? "; secure" : "";
-		document.cookie = name + "=; max-age=0; path=/; SameSite=Lax" + secure;
-	}
-
-	function clearReadableAuthCookies() {
-		clearCookie("es-creds");
-		clearCookie("oauth_token");
-	}
-
 	function setStatus(message) {
 		var status = document.querySelector("[data-ui-oauth-status]");
 		if (!status)
@@ -113,7 +30,7 @@
 				throw new Error("The configured provider does not advertise an OAuth browser flow.");
 
 			var baseUrl = window.location.protocol + "//" + window.location.host;
-			var challengeResponse = await originalFetch(baseUrl + properties.code_challenge_uri);
+			var challengeResponse = await window.fetch(baseUrl + properties.code_challenge_uri);
 			if (!challengeResponse.ok)
 				throw new Error("Code challenge endpoint returned " + challengeResponse.status + " " + challengeResponse.statusText);
 
@@ -134,37 +51,12 @@
 				"&code_challenge_method=" + encodeURIComponent(challenge.code_challenge_method) +
 				"&state=" + encodeURIComponent(state);
 
-			if (returnUrl)
-				sessionStorage.setItem("eventstore-ui-return-url", returnUrl);
-
 			window.location.href = target;
 		} catch (error) {
 			setStatus(error && error.message ? error.message : "Unable to start the browser sign-in flow.");
 		}
 	}
 
-	document.addEventListener("DOMContentLoaded", function () {
-		if (document.querySelector("[data-ui-clear-auth]"))
-			clearReadableAuthCookies();
-
-		if (window.location.pathname !== "/ui/signin")
-			return;
-
-		var returnUrl = sessionStorage.getItem("eventstore-ui-return-url");
-		if (!readAuthorization())
-			return;
-
-		if (returnUrl) {
-			sessionStorage.removeItem("eventstore-ui-return-url");
-			window.location.href = returnUrl;
-			return;
-		}
-
-		var query = new URLSearchParams(window.location.search);
-		if (query.has("code") || query.has("state"))
-			window.location.href = "/ui";
-	});
-
 	document.addEventListener("click", function (event) {
 		var button = event.target.closest("[data-ui-oauth-signin]");
 		if (!button)
@@ -173,8 +65,4 @@
 		event.preventDefault();
 		beginOAuthSignIn(button);
 	});
-
-	window.EventStoreUiAuth = {
-		readAuthorization: readAuthorization
-	};
 }());
diff --git a/src/EventStore.Core.Tests/Authentication/InternalSessionAuthenticationTests.cs b/src/EventStore.Core.Tests/Authentication/InternalSessionAuthenticationTests.cs
new file mode 100644
index 0000000000..d9d2111d82
--- /dev/null
+++ b/src/EventStore.Core.Tests/Authentication/InternalSessionAuthenticationTests.cs
@@ -0,0 +1,200 @@
+using System;
+using System.Linq;
+using System.Security.Claims;
+using System.Threading;
+using System.Threading.Tasks;
+using EventStore.Core.Authentication;
+using EventStore.Core.Authentication.DelegatedAuthentication;
+using EventStore.Core.Authentication.InternalAuthentication;
+using EventStore.Core.Messages;
+using NUnit.Framework;
+
+namespace EventStore.Core.Tests.Authentication;
+
+[TestFixture(typeof(LogFormat.V2), typeof(string))]
+[FixtureLifeCycle(LifeCycle.InstancePerTestCase)]
+public class InternalSessionAuthenticationTests<TLogFormat, TStreamId> :
+	with_internal_authentication_provider<TLogFormat, TStreamId>
+{
+	protected override void Given() =>
+		ExistingEvent("$user-user", "$UserCreated", null,
+			"{LoginName:'user',Salt:'drowssap',Hash:'password',Groups:['reader']}");
+
+	[SetUp]
+	public void SetUp() => SetUpProvider();
+
+	private ClaimsPrincipal SignIn()
+	{
+		ClaimsPrincipal principal = null;
+		_internalAuthenticationProvider.Authenticate(new TestAuthenticationRequest("user", "password",
+			() => Assert.Fail("Authentication rejected valid credentials"), value => principal = value,
+			() => Assert.Fail("Authentication failed"), () => Assert.Fail("Authentication not ready")));
+		return principal;
+	}
+
+	private ClaimsPrincipal SignInSession(string password = "password", ISessionAuthenticationProvider provider = null)
+	{
+		ClaimsPrincipal principal = null;
+		(provider ?? _internalAuthenticationProvider).AuthenticateSession(new TestAuthenticationRequest("user", password,
+			() => { }, value => principal = value,
+			() => Assert.Fail("Authentication failed"), () => Assert.Fail("Authentication not ready")));
+		return principal;
+	}
+
+	[Test]
+	public void successful_password_authentication_provides_account_version_for_session_validation()
+	{
+		var principal = SignIn();
+		Assert.That(principal.FindFirst("es:session-security-stamp")?.Value, Is.Not.Null.And.Not.Empty);
+	}
+
+	[Test]
+	public async Task session_validation_reads_current_account_and_rebuilds_roles()
+	{
+		var principal = SignIn();
+		((ClaimsIdentity)principal.Identity).AddClaim(new Claim(ClaimTypes.Role, "$admins"));
+		_consumer.HandledMessages.Clear();
+
+		var validated = await _internalAuthenticationProvider.ValidateSessionAsync(principal, CancellationToken.None);
+
+		Assert.That(validated.Identity.Name, Is.EqualTo("user"));
+		Assert.That(validated.IsInRole("reader"), Is.True);
+		Assert.That(validated.IsInRole("$admins"), Is.False);
+		Assert.That(_consumer.HandledMessages.OfType<ClientMessage.ReadStreamEventsBackward>().Count(), Is.EqualTo(1));
+	}
+
+	[TestCase("{LoginName:'user',Salt:'drowssap',Hash:'newpassword',Groups:['reader']}")]
+	[TestCase("{LoginName:'user',Salt:'drowssap',Hash:'password',Groups:['other']}")]
+	[TestCase("{LoginName:'user',Salt:'drowssap',Hash:'password',Groups:['reader'],Disabled:true}")]
+	[TestCase("{LoginName:'user',Salt:'drowssap',Hash:'password',Groups:['reader']}")]
+	public async Task any_account_update_revokes_session_without_waiting_for_cache_notification(string account)
+	{
+		var principal = SignIn();
+		ExistingEvent("$user-user", "$UserUpdated", null, account);
+
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(principal, CancellationToken.None), Is.Null);
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(SignIn(), CancellationToken.None), Is.Null);
+	}
+
+	[Test]
+	public async Task fresh_password_sign_in_after_account_update_can_create_session_without_cache_notification()
+	{
+		var oldPrincipal = SignIn();
+		ExistingEvent("$user-user", "$UserUpdated", null,
+			"{LoginName:'user',Salt:'drowssap',Hash:'password',Groups:['other']}");
+
+		var current = await _internalAuthenticationProvider.ValidateSessionAsync(SignInSession(), CancellationToken.None);
+
+		Assert.That(current, Is.Not.Null);
+		Assert.That(current.IsInRole("other"), Is.True);
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(oldPrincipal, CancellationToken.None), Is.Null);
+	}
+
+	[TestCase("{LoginName:'user',Salt:'drowssap',Hash:'newpassword',Groups:['reader']}")]
+	[TestCase("{LoginName:'user',Salt:'drowssap',Hash:'password',Groups:['reader'],Disabled:true}")]
+	public void new_session_rejects_cached_password_after_password_change_or_disable(string account)
+	{
+		SignIn();
+		ExistingEvent("$user-user", "$UserUpdated", null, account);
+
+		Assert.That(SignInSession(), Is.Null);
+	}
+
+	[Test]
+	public async Task new_session_accepts_changed_password_without_cache_notification()
+	{
+		var oldPrincipal = SignIn();
+		ExistingEvent("$user-user", "$UserUpdated", null,
+			"{LoginName:'user',Salt:'drowssapwen',Hash:'newpassword',Groups:['reader']}");
+
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(SignInSession("newpassword"), CancellationToken.None), Is.Not.Null);
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(oldPrincipal, CancellationToken.None), Is.Null);
+	}
+
+	[Test]
+	public async Task delegated_composite_session_sign_in_reads_current_account_without_retaining_credentials()
+	{
+		SignIn();
+		ExistingEvent("$user-user", "$UserUpdated", null,
+			"{LoginName:'user',Salt:'drowssap',Hash:'password',Groups:['other']}");
+		var provider = new DelegatedAuthenticationProvider(new CompositeAuthenticationProvider([_internalAuthenticationProvider]));
+
+		var principal = SignInSession(provider: provider);
+
+		Assert.That(principal, Is.Not.Null);
+		Assert.That(principal.Identities.OfType<DelegatedClaimsIdentity>(), Is.Empty);
+		Assert.That((await provider.ValidateSessionAsync(principal, CancellationToken.None)).IsInRole("other"), Is.True);
+	}
+
+	[Test]
+	public async Task deleting_account_revokes_session()
+	{
+		var principal = SignIn();
+		DeletedStream("$user-user");
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(principal, CancellationToken.None), Is.Null);
+	}
+
+	[Test]
+	public async Task missing_account_revokes_session()
+	{
+		var principal = SignIn();
+		NoStream("$user-user");
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(principal, CancellationToken.None), Is.Null);
+	}
+
+	[Test]
+	public async Task unavailable_account_read_fails_closed()
+	{
+		var principal = SignIn();
+		NotReady();
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(principal, CancellationToken.None), Is.Null);
+	}
+
+	[Test]
+	public async Task cancellation_of_pending_read_fails_closed()
+	{
+		var principal = SignIn();
+		ReadsBackwardQueuesUp();
+		using var cancellation = new CancellationTokenSource();
+		var validation = _internalAuthenticationProvider.ValidateSessionAsync(principal, cancellation.Token);
+		cancellation.Cancel();
+		Assert.That(await validation.WaitAsync(TimeSpan.FromSeconds(1)), Is.Null);
+		CompleteOneReadBackwards();
+	}
+
+	[Test]
+	public async Task unavailable_read_has_bounded_wait_even_without_dispatcher_timeout()
+	{
+		var principal = SignIn();
+		ReadsBackwardQueuesUp();
+		var validation = _internalAuthenticationProvider.ValidateSessionAsync(principal, CancellationToken.None);
+		Assert.That(await validation.WaitAsync(TimeSpan.FromSeconds(10)), Is.Null);
+		CompleteOneReadBackwards();
+	}
+
+	[Test]
+	public async Task absent_security_stamp_fails_closed_without_reading()
+	{
+		var principal = new ClaimsPrincipal(new ClaimsIdentity([new Claim(ClaimTypes.Name, "user")], "test"));
+		_consumer.HandledMessages.Clear();
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(principal, CancellationToken.None), Is.Null);
+		Assert.That(_consumer.HandledMessages.OfType<ClientMessage.ReadStreamEventsBackward>(), Is.Empty);
+	}
+
+	[Test]
+	public async Task delegated_composite_provider_preserves_session_validation()
+	{
+		var provider = new DelegatedAuthenticationProvider(new CompositeAuthenticationProvider([_internalAuthenticationProvider]));
+		Assert.That(await provider.ValidateSessionAsync(SignIn(), CancellationToken.None), Is.Not.Null);
+	}
+
+	[Test]
+	public async Task incorrect_stamp_fails_closed()
+	{
+		var principal = SignIn();
+		var identity = (ClaimsIdentity)principal.Identity;
+		identity.RemoveClaim(identity.FindFirst(InternalAuthenticationProvider.SessionSecurityStampClaimType));
+		identity.AddClaim(new Claim(InternalAuthenticationProvider.SessionSecurityStampClaimType, Guid.NewGuid().ToString("N")));
+		Assert.That(await _internalAuthenticationProvider.ValidateSessionAsync(principal, CancellationToken.None), Is.Null);
+	}
+}
diff --git a/src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs b/src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs
index d4605b26f1..560c622d68 100644
--- a/src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs
+++ b/src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs
@@ -11,6 +11,8 @@
 using EventStore.ClusterNode.Components.Services;
 using EventStore.Core;
 using EventStore.Core.Authentication.OAuth;
+using EventStore.Plugins.Authentication;
+using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
@@ -28,6 +30,118 @@ public class OAuthBrowserFlowServiceTests
 		new(Guid.Parse("aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee").ToByteArray().Concat(
 			Guid.Parse("11111111-2222-3333-4444-555555555555").ToByteArray()).ToArray());
 	private static readonly string JwtToken = CreateToken(audience: "eventstore");
+	private ServiceProvider _services;
+	private ControlledAuthenticationProvider _authenticationProvider;
+	private readonly List<IServiceScope> _requestScopes = [];
+
+	[SetUp]
+	public void SetUp()
+	{
+		var services = new ServiceCollection().AddLogging();
+		services.AddDataProtection().UseEphemeralDataProtectionProvider();
+		_authenticationProvider = new ControlledAuthenticationProvider(new OAuthAuthenticationProvider(
+			Options(), false, _ => new ValueTask<TokenValidationParameters>(CreateValidationParameters())));
+		services.AddSingleton<IAuthenticationProvider>(_authenticationProvider);
+		services.AddUiSessionAuthentication();
+		_services = services.BuildServiceProvider();
+	}
+
+	[TearDown]
+	public void TearDown()
+	{
+		foreach (var scope in _requestScopes)
+			scope.Dispose();
+		_requestScopes.Clear();
+		_services.Dispose();
+	}
+
+	[Test]
+	public async Task callback_authentication_timeout_redirects_without_issuing_session()
+	{
+		using var service = Service(new TokenHandler());
+		var context = CallbackContext(service);
+		_authenticationProvider.CompleteRequests = false;
+
+		var result = await service.HandleCallback(context, CancellationToken.None);
+		await result.ExecuteAsync(context);
+
+		Assert.That(context.Response.StatusCode, Is.EqualTo(StatusCodes.Status302Found));
+		Assert.That(context.Response.Headers.Location.ToString(), Does.Contain("oauth_error=invalid_token"));
+		Assert.That(context.Response.Headers.SetCookie.ToString(), Does.Not.Contain(UiSessionAuthentication.CookieName + "="));
+	}
+
+	[Test]
+	public async Task session_authentication_timeout_revokes_cookie_even_after_provider_recovers()
+	{
+		var signIn = HttpsContext();
+		await UiSessionAuthentication.SignInAsync(signIn,
+			new ClaimsPrincipal(new ClaimsIdentity([new Claim(ClaimTypes.Name, "alice")], "test")), JwtToken);
+		var cookie = signIn.Response.Headers.SetCookie.Last(x => x.StartsWith(UiSessionAuthentication.CookieName + "=")).Split(';')[0];
+		var context = HttpsContext();
+		context.Request.Headers.Cookie = cookie;
+		_authenticationProvider.CompleteRequests = false;
+
+		var result = await context.AuthenticateAsync(UiSessionAuthentication.Scheme);
+
+		Assert.That(result.Succeeded, Is.False);
+		Assert.That(context.Response.Headers.SetCookie.ToString(), Does.Contain(UiSessionAuthentication.CookieName + "=;"));
+		_authenticationProvider.CompleteRequests = true;
+		var replay = HttpsContext();
+		replay.Request.Headers.Cookie = cookie;
+		Assert.That((await replay.AuthenticateAsync(UiSessionAuthentication.Scheme)).Succeeded, Is.False);
+	}
+
+	[Test]
+	public void callback_request_cancellation_is_not_a_token_rejection()
+	{
+		using var service = Service(new TokenHandler());
+		using var cancellation = new CancellationTokenSource();
+		var context = CallbackContext(service);
+		_authenticationProvider.CompleteRequests = false;
+		_authenticationProvider.OnAuthenticate = cancellation.Cancel;
+
+		Assert.That(async () => await service.HandleCallback(context, cancellation.Token),
+			Throws.InstanceOf<OperationCanceledException>());
+		Assert.That(context.Response.Headers.Location.ToString(), Is.Empty);
+	}
+
+	[Test]
+	public async Task session_request_cancellation_does_not_revoke_session()
+	{
+		var signIn = HttpsContext();
+		await UiSessionAuthentication.SignInAsync(signIn,
+			new ClaimsPrincipal(new ClaimsIdentity([new Claim(ClaimTypes.Name, "alice")], "test")), JwtToken);
+		var cookie = signIn.Response.Headers.SetCookie.Last(x => x.StartsWith(UiSessionAuthentication.CookieName + "=")).Split(';')[0];
+		using var cancellation = new CancellationTokenSource();
+		var context = HttpsContext();
+		context.Request.Headers.Cookie = cookie;
+		context.RequestAborted = cancellation.Token;
+		_authenticationProvider.CompleteRequests = false;
+		_authenticationProvider.OnAuthenticate = cancellation.Cancel;
+
+		Assert.That(async () => await context.AuthenticateAsync(UiSessionAuthentication.Scheme),
+			Throws.InstanceOf<OperationCanceledException>());
+
+		_authenticationProvider.CompleteRequests = true;
+		_authenticationProvider.OnAuthenticate = null;
+		var retry = HttpsContext();
+		retry.Request.Headers.Cookie = cookie;
+		Assert.That((await retry.AuthenticateAsync(UiSessionAuthentication.Scheme)).Succeeded, Is.True);
+	}
+
+	private DefaultHttpContext CallbackContext(OAuthBrowserFlowService service)
+	{
+		var challengeContext = HttpsContext();
+		var challenge = service.CreateCodeChallenge(challengeContext);
+		var context = HttpsContext();
+		context.Request.Headers.Cookie = challengeContext.Response.Headers.SetCookie.ToString().Split(';')[0];
+		context.Request.Query = new QueryCollection(new Dictionary<string, StringValues>
+		{
+			["code"] = "authorization-code",
+			["state"] = State(challenge.CodeChallengeCorrelationId)
+		});
+		return context;
+	}
 
 	[Test]
 	public void creates_code_challenge_using_browser_contract_names()
@@ -48,7 +162,7 @@ public void creates_code_challenge_using_browser_contract_names()
 	}
 
 	[Test]
-	public async Task callback_exchanges_code_and_sets_oauth_token_cookie()
+	public async Task callback_exchanges_code_and_sets_protected_session_cookie()
 	{
 		var handler = new TokenHandler();
 		var service = Service(handler);
@@ -67,7 +181,7 @@ public async Task callback_exchanges_code_and_sets_oauth_token_cookie()
 
 		Assert.AreEqual(HttpStatusCode.Redirect, (HttpStatusCode)context.Response.StatusCode);
 		Assert.That(context.Response.Headers.Location.ToString(), Is.EqualTo("/ui/signin?returnUrl=%2Fui%2Fstreams"));
-		Assert.That(context.Response.Headers.SetCookie.ToString(), Does.Contain($"{UiCredentialCookie.OAuthCookieName}={JwtToken}"));
+		await AssertSessionCookie(context);
 		Assert.That(handler.Body, Does.Contain("grant_type=authorization_code"));
 		Assert.That(handler.Body, Does.Contain("client_id=eventstore-ui"));
 		Assert.That(handler.Body, Does.Contain("redirect_uri=https%3A%2F%2Fnode.example.test%2Fui%2Fauth%2Foauth%2Fcallback"));
@@ -94,7 +208,7 @@ public async Task callback_redirects_to_return_url_when_admin_ui_is_disabled()
 
 		Assert.AreEqual(HttpStatusCode.Redirect, (HttpStatusCode)context.Response.StatusCode);
 		Assert.That(context.Response.Headers.Location.ToString(), Is.EqualTo("/"));
-		Assert.That(context.Response.Headers.SetCookie.ToString(), Does.Contain($"{UiCredentialCookie.OAuthCookieName}={JwtToken}"));
+		await AssertSessionCookie(context);
 	}
 
 	[Test]
@@ -244,7 +358,7 @@ public async Task callback_exchanges_code_with_redirect_uri_from_state()
 		var challengeContext = HttpsContext();
 		var challenge = service.CreateCodeChallenge(challengeContext);
 		var context = HttpsContext();
-		context.Request.Scheme = "http";
+		context.Request.Scheme = "https";
 		context.Request.Host = new HostString("internal-node:2113");
 		context.Request.Headers.Cookie = challengeContext.Response.Headers.SetCookie.ToString().Split(';')[0];
 		context.Request.Query = new QueryCollection(new Dictionary<string, StringValues>
@@ -318,17 +432,51 @@ private static TokenValidationParameters CreateValidationParameters() =>
 			RoleClaimType = "roles"
 		};
 
-	private static DefaultHttpContext HttpsContext()
+	private async Task AssertSessionCookie(HttpContext context)
+	{
+		var cookies = context.Response.Headers.SetCookie;
+		var session = cookies.Last(cookie => cookie.StartsWith(UiSessionAuthentication.CookieName + "=", StringComparison.Ordinal));
+		Assert.That(session, Does.Contain("httponly"));
+		Assert.That(session, Does.Contain("secure"));
+		Assert.That(session, Does.Contain("samesite=lax"));
+		Assert.That(cookies.ToString(), Does.Not.Contain(JwtToken));
+		Assert.That(cookies.Single(cookie => cookie.StartsWith(UiCredentialCookie.OAuthCookieName + "=", StringComparison.Ordinal)),
+			Does.StartWith(UiCredentialCookie.OAuthCookieName + "=;"));
+		var authenticatedContext = HttpsContext();
+		authenticatedContext.Request.Headers.Cookie = session.Split(';')[0];
+		var result = await authenticatedContext.AuthenticateAsync(UiSessionAuthentication.Scheme);
+		Assert.That(result.Succeeded, Is.True);
+		Assert.That(result.Principal.Identity.Name, Is.EqualTo("alice"));
+		Assert.That(result.Properties.ExpiresUtc - result.Properties.IssuedUtc,
+			Is.LessThanOrEqualTo(UiSessionAuthentication.Lifetime));
+	}
+
+	private DefaultHttpContext HttpsContext()
 	{
+		var scope = _services.CreateScope();
+		_requestScopes.Add(scope);
 		var context = new DefaultHttpContext
 		{
-			RequestServices = new ServiceCollection().AddLogging().BuildServiceProvider()
+			RequestServices = scope.ServiceProvider
 		};
 		context.Request.Scheme = "https";
 		context.Request.Host = new HostString("node.example.test");
 		return context;
 	}
 
+	private sealed class ControlledAuthenticationProvider(IAuthenticationProvider inner) : AuthenticationProviderBase("test")
+	{
+		public bool CompleteRequests = true;
+		public Action OnAuthenticate;
+		public override IReadOnlyList<string> GetSupportedAuthenticationSchemes() => inner.GetSupportedAuthenticationSchemes();
+		public override void Authenticate(AuthenticationRequest request)
+		{
+			OnAuthenticate?.Invoke();
+			if (CompleteRequests)
+				inner.Authenticate(request);
+		}
+	}
+
 	private sealed class TokenHandler : HttpMessageHandler
 	{
 		private readonly string _response;
diff --git a/src/EventStore.Core.Tests/Authentication/UiSessionIntegrationTests.cs b/src/EventStore.Core.Tests/Authentication/UiSessionIntegrationTests.cs
new file mode 100644
index 0000000000..dc0a36dd90
--- /dev/null
+++ b/src/EventStore.Core.Tests/Authentication/UiSessionIntegrationTests.cs
@@ -0,0 +1,237 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Security.Claims;
+using System.Threading;
+using System.Threading.Tasks;
+using EventStore.ClusterNode.Components.Services;
+using EventStore.Core.Authentication;
+using EventStore.Core.Authentication.InternalAuthentication;
+using EventStore.Core.Services.Transport.Http;
+using EventStore.Core.Services.Transport.Http.Authentication;
+using EventStore.Plugins.Authentication;
+using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Options;
+using NUnit.Framework;
+
+namespace EventStore.Core.Tests.Authentication;
+
+[TestFixture]
+public class UiSessionIntegrationTests
+{
+	private TestServer _server;
+	private IHost _host;
+	private HttpClient _client;
+	private SessionProvider _provider;
+	private SessionClock _clock;
+
+	[SetUp]
+	public async Task SetUp()
+	{
+		_provider = new SessionProvider();
+		_clock = new SessionClock();
+		_host = await new HostBuilder().ConfigureWebHost(web => web.UseTestServer()
+			.ConfigureServices(services =>
+			{
+				services.AddRouting();
+				services.AddLogging();
+				services.AddDataProtection();
+				services.AddSingleton<IAuthenticationProvider>(_provider);
+				services.AddSingleton<IReadOnlyList<IHttpAuthenticationProvider>>([
+					new BasicHttpAuthenticationProvider(_provider), new AnonymousHttpAuthenticationProvider()]);
+				services.AddSingleton<EventStore.Core.Services.Transport.Http.AuthenticationMiddleware>();
+				services.AddAuthentication(options =>
+				{
+					options.DefaultAuthenticateScheme = "es auth";
+					options.DefaultChallengeScheme = "es auth";
+					options.AddScheme<EventStoreAuthenticationHandler>("es auth", null);
+				});
+				services.AddAuthorization();
+				services.AddAntiforgery();
+				services.AddUiSessionAuthentication();
+				services.Configure<CookieAuthenticationOptions>(UiSessionAuthentication.Scheme, options => options.TimeProvider = _clock);
+			})
+			.Configure(app =>
+			{
+				app.UseMiddleware<UiCredentialsMiddleware>();
+				app.UseMiddleware<EventStore.Core.Services.Transport.Http.AuthenticationMiddleware>();
+				app.UseAuthentication();
+				app.UseRouting();
+				app.UseAuthorization();
+				app.UseAntiforgery();
+				app.UseEndpoints(endpoints =>
+				{
+					endpoints.MapPost("/ui/login", async context =>
+					{
+						var result = await new SecurityBrowserService(_provider, true).SignInAsync(context, "admin", "correct-password");
+						context.Response.StatusCode = result.Success ? 204 : 401;
+					});
+					endpoints.MapGet("/ui/me", context => context.Response.WriteAsync(context.User.Identity?.Name ?? "anonymous"));
+					endpoints.MapGet("/outside", context => context.Response.WriteAsync(context.User.Identity?.Name ?? "anonymous"));
+					endpoints.MapGet("/ui/csrf", context => context.Response.WriteAsync(
+						context.RequestServices.GetRequiredService<IAntiforgery>().GetAndStoreTokens(context).RequestToken));
+					endpoints.MapPost("/ui/change", context => { context.Response.StatusCode = 204; return Task.CompletedTask; }).RequireAuthorization();
+					endpoints.MapPost("/ui/logout", context => context.SignOutAsync(UiSessionAuthentication.Scheme)).RequireAuthorization();
+				});
+			})).StartAsync();
+		_server = _host.GetTestServer();
+		_client = _server.CreateClient();
+		_client.BaseAddress = new Uri("https://localhost");
+	}
+
+	[TearDown]
+	public void TearDown()
+	{
+		_client.Dispose();
+		_host.Dispose();
+	}
+
+	[Test]
+	public async Task login_issues_protected_identifier_without_password_or_identity_in_browser()
+	{
+		var response = await _client.PostAsync("/ui/login", null);
+		Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.NoContent));
+		var header = response.Headers.GetValues("Set-Cookie").Last(x => x.StartsWith(UiSessionAuthentication.CookieName + "="));
+		Assert.That(header, Does.Contain("secure").And.Contain("httponly").And.Contain("samesite=lax"));
+		Assert.That(header, Does.Not.Contain("correct-password").And.Not.Contain("admin"));
+		var cookie = header.Split(';')[0];
+		var options = _server.Services.GetRequiredService<IOptionsMonitor<CookieAuthenticationOptions>>().Get(UiSessionAuthentication.Scheme);
+		var browserTicket = options.TicketDataFormat.Unprotect(Uri.UnescapeDataString(cookie[(cookie.IndexOf('=') + 1)..]));
+		Assert.That(browserTicket, Is.Not.Null);
+		Assert.That(browserTicket.Principal.Identity?.Name, Is.Null);
+		Assert.That(browserTicket.Properties.Items.Values, Has.None.Contains("correct-password"));
+		_client.DefaultRequestHeaders.Add("Cookie", cookie);
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("admin"));
+		Assert.That(_provider.PasswordChecks, Is.EqualTo(1));
+		Assert.That(_provider.SessionChecks, Is.EqualTo(1));
+	}
+
+	[Test]
+	public async Task signing_in_again_rotates_session_and_does_not_revive_old_cookie()
+	{
+		await Login();
+		_client.DefaultRequestHeaders.Add("Authorization", "Basic YWRtaW46Y29ycmVjdC1wYXNzd29yZA==");
+		var response = await _client.PostAsync("/ui/login", null);
+		Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.NoContent));
+		_client.DefaultRequestHeaders.Remove("Authorization");
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("anonymous"));
+		_client.DefaultRequestHeaders.Remove("Cookie");
+		_client.DefaultRequestHeaders.Add("Cookie", response.Headers.GetValues("Set-Cookie")
+			.Last(x => x.StartsWith(UiSessionAuthentication.CookieName + "=")).Split(';')[0]);
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("admin"));
+	}
+
+	[Test]
+	public async Task session_expires_absolutely_without_sliding_renewal()
+	{
+		await Login();
+		_clock.Advance(TimeSpan.FromMinutes(14));
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("admin"));
+		_clock.Advance(TimeSpan.FromMinutes(2));
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("anonymous"));
+	}
+
+	[Test]
+	public async Task revoked_account_cannot_reuse_session_even_if_reenabled_later()
+	{
+		await Login();
+		_provider.Valid = false;
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("anonymous"));
+		_provider.Valid = true;
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("anonymous"));
+	}
+
+	[Test]
+	public async Task csrf_is_required_for_cookie_authenticated_mutations_and_logout_revokes_replay()
+	{
+		var cookie = await Login();
+		Assert.That((await _client.PostAsync("/ui/change", null)).StatusCode, Is.EqualTo(HttpStatusCode.BadRequest));
+		var csrf = await _client.GetAsync("/ui/csrf");
+		var token = await csrf.Content.ReadAsStringAsync();
+		_client.DefaultRequestHeaders.Remove("Cookie");
+		_client.DefaultRequestHeaders.Add("Cookie", cookie + "; " + csrf.Headers.GetValues("Set-Cookie").First().Split(';')[0]);
+		_client.DefaultRequestHeaders.Add("RequestVerificationToken", token);
+		Assert.That((await _client.PostAsync("/ui/change", null)).StatusCode, Is.EqualTo(HttpStatusCode.NoContent));
+		Assert.That((await _client.PostAsync("/ui/logout", null)).IsSuccessStatusCode, Is.True);
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("anonymous"));
+	}
+
+	[Test]
+	public async Task cookie_does_not_authenticate_outside_ui_or_override_explicit_credentials()
+	{
+		await Login();
+		Assert.That(await _client.GetStringAsync("/outside"), Is.EqualTo("anonymous"));
+		_client.DefaultRequestHeaders.Add("Authorization", "Basic YWRtaW46d3Jvbmc=");
+		Assert.That((await _client.GetAsync("/ui/me")).StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+	}
+
+	[Test]
+	public async Task tampered_cookie_cannot_authenticate()
+	{
+		var cookie = await Login();
+		_client.DefaultRequestHeaders.Remove("Cookie");
+		_client.DefaultRequestHeaders.Add("Cookie", cookie.Insert(cookie.IndexOf('=') + 10, "tampered"));
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("anonymous"));
+	}
+
+	[Test]
+	public async Task http_cannot_issue_or_use_a_browser_session()
+	{
+		await Login();
+		Assert.That(await _client.GetStringAsync("http://localhost/ui/me"), Is.EqualTo("anonymous"));
+		Assert.That((await _client.PostAsync("http://localhost/ui/login", null)).StatusCode, Is.EqualTo(HttpStatusCode.Unauthorized));
+	}
+
+	private async Task<string> Login()
+	{
+		var response = await _client.PostAsync("/ui/login", null);
+		Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.NoContent));
+		var cookie = response.Headers.GetValues("Set-Cookie").Last(x => x.StartsWith(UiSessionAuthentication.CookieName + "=")).Split(';')[0];
+		_client.DefaultRequestHeaders.Add("Cookie", cookie);
+		return cookie;
+	}
+
+	private sealed class SessionClock : TimeProvider
+	{
+		private DateTimeOffset _now = DateTimeOffset.UtcNow;
+		public override DateTimeOffset GetUtcNow() => _now;
+		public void Advance(TimeSpan amount) => _now += amount;
+	}
+
+	private sealed class SessionProvider : AuthenticationProviderBase, ISessionAuthenticationProvider
+	{
+		public bool Valid = true;
+		public int PasswordChecks;
+		public int SessionChecks;
+		public SessionProvider() : base("test") { }
+		public void AuthenticateSession(AuthenticationRequest request)
+		{
+			SessionChecks++;
+			Authenticate(request);
+		}
+		public override IReadOnlyList<string> GetSupportedAuthenticationSchemes() => ["Basic"];
+		public override void Authenticate(AuthenticationRequest request)
+		{
+			PasswordChecks++;
+			if (request.SuppliedPassword == "correct-password")
+				request.Authenticated(Principal());
+			else
+				request.Unauthorized();
+		}
+		public Task<ClaimsPrincipal> ValidateSessionAsync(ClaimsPrincipal principal, CancellationToken cancellationToken) =>
+			Task.FromResult(Valid ? Principal() : null);
+		private static ClaimsPrincipal Principal() => new(new ClaimsIdentity([
+			new Claim(ClaimTypes.Name, "admin"), new Claim(ClaimTypes.Role, "$admins"),
+			new Claim(InternalAuthenticationProvider.SessionSecurityStampClaimType, "verified-revision")], "test"));
+	}
+}
diff --git a/src/EventStore.Core.Tests/Authentication/UiSessionSecurityTests.cs b/src/EventStore.Core.Tests/Authentication/UiSessionSecurityTests.cs
new file mode 100644
index 0000000000..44c22d9bd3
--- /dev/null
+++ b/src/EventStore.Core.Tests/Authentication/UiSessionSecurityTests.cs
@@ -0,0 +1,31 @@
+using System;
+using System.Text;
+using System.Text.Json;
+using System.Threading.Tasks;
+using EventStore.ClusterNode.Components.Services;
+using Microsoft.AspNetCore.Http;
+using NUnit.Framework;
+
+namespace EventStore.Core.Tests.Authentication;
+
+[TestFixture]
+public class UiSessionSecurityTests
+{
+	[Test]
+	public async Task legacy_password_cookie_cannot_authenticate_a_request()
+	{
+		var context = new DefaultHttpContext();
+		context.Request.Scheme = "https";
+		context.Request.Path = "/ui";
+		var credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes("admin:secret-password"));
+		context.Request.Headers.Cookie = "es-creds=" + Uri.EscapeDataString(
+			JsonSerializer.Serialize(new { credentials }));
+		var middleware = new UiCredentialsMiddleware(_ => Task.CompletedTask);
+
+		await middleware.InvokeAsync(context);
+
+		Assert.That(context.Request.Headers.Authorization.ToString(), Is.Empty,
+			"Browser cookies must never be promoted into reusable Basic credentials.");
+		Assert.That(context.User.Identity?.IsAuthenticated, Is.Not.True);
+	}
+}
diff --git a/src/EventStore.Core.Tests/Authentication/UiSessionTicketStoreTests.cs b/src/EventStore.Core.Tests/Authentication/UiSessionTicketStoreTests.cs
new file mode 100644
index 0000000000..92e30f88e0
--- /dev/null
+++ b/src/EventStore.Core.Tests/Authentication/UiSessionTicketStoreTests.cs
@@ -0,0 +1,24 @@
+using System;
+using System.Security.Claims;
+using System.Threading.Tasks;
+using EventStore.ClusterNode.Components.Services;
+using Microsoft.AspNetCore.Authentication;
+using NUnit.Framework;
+
+namespace EventStore.Core.Tests.Authentication;
+
+[TestFixture]
+public class UiSessionTicketStoreTests
+{
+	[Test]
+	public async Task capacity_exhaustion_fails_instead_of_issuing_an_unusable_session()
+	{
+		using var store = new UiSessionTicketStore();
+		var ticket = new AuthenticationTicket(new ClaimsPrincipal(new ClaimsIdentity("test")),
+			new AuthenticationProperties { ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(15) }, "test");
+		for (var i = 0; i < 10_000; i++)
+			await store.StoreAsync(ticket);
+
+		Assert.ThrowsAsync<InvalidOperationException>(() => store.StoreAsync(ticket));
+	}
+}
diff --git a/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingGrpcCodecTests.cs b/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingGrpcCodecTests.cs
index 1021429c12..828810fab5 100644
--- a/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingGrpcCodecTests.cs
+++ b/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingGrpcCodecTests.cs
@@ -4,6 +4,7 @@
 using System.Net;
 using System.Security.Claims;
 using System.Threading;
+using EventStore.Core.Authentication;
 using EventStore.Core.Authentication.DelegatedAuthentication;
 using EventStore.Core.Data;
 using EventStore.Core.Messages;
@@ -207,6 +208,31 @@ public void trusted_system_identity_round_trips()
 		Assert.That(identity, Is.TypeOf<ForwardingIdentity.TrustedSystem>());
 	}
 
+	[Test]
+	public void authenticated_session_identity_is_not_forwarded_as_anonymous()
+	{
+		var stamp = Guid.NewGuid();
+		var user = new ClaimsPrincipal(new LocalSessionClaimsIdentity([
+			new Claim(ClaimTypes.Name, "writer"),
+			new Claim("es:session-security-stamp", stamp.ToString("N"))
+		]));
+
+		Assert.That(RoundTripIdentity(CreateTransactionStart(user)), Is.EqualTo(new ForwardingIdentity.LocalSession("writer", stamp)));
+		Assert.That(ForwardingGrpcCodec.RequiresTls(CreateTransactionStart(user)), Is.True);
+		Assert.That(() => ForwardingGrpcCodec.ToGrpc(CreateTransactionStart(user), ForwardingTransportSecurity.Cleartext),
+			Throws.InvalidOperationException);
+	}
+
+	[Test]
+	public void external_claims_cannot_impersonate_local_session_identity()
+	{
+		var principal = new ClaimsPrincipal(new ClaimsIdentity([
+			new Claim(ClaimTypes.Name, "writer"),
+			new Claim("es:session-security-stamp", Guid.NewGuid().ToString("N"))
+		], "external"));
+		Assert.That(RoundTripIdentity(CreateTransactionStart(principal)), Is.TypeOf<ForwardingIdentity.Anonymous>());
+	}
+
 	[Test]
 	public void delegated_bearer_identity_round_trips()
 	{
diff --git a/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingServiceTests.cs b/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingServiceTests.cs
index dfd488bfc0..afe6a2a6fb 100644
--- a/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingServiceTests.cs
+++ b/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingServiceTests.cs
@@ -9,6 +9,7 @@
 using System.Security.Cryptography.X509Certificates;
 using System.Threading;
 using System.Threading.Tasks;
+using EventStore.Core.Authentication;
 using EventStore.Core.Authentication.DelegatedAuthentication;
 using EventStore.Core.Authorization;
 using EventStore.Core.Bus;
@@ -241,6 +242,71 @@ await service.Forward(
 		});
 	}
 
+	[TestCase(true)]
+	[TestCase(false)]
+	public async Task session_identity_requires_current_account_validation(bool isValid)
+	{
+		using var certificate = CreateCertificate("node");
+		var stamp = Guid.NewGuid();
+		var sessionUser = new ClaimsPrincipal(new LocalSessionClaimsIdentity([
+			new Claim(ClaimTypes.Name, "writer"), new Claim("es:session-security-stamp", stamp.ToString("N")),
+			new Claim(ClaimTypes.Role, "$admins")
+		]));
+		var validatedUser = new ClaimsPrincipal(new ClaimsIdentity([new Claim(ClaimTypes.Name, "writer")], "ES-Legacy"));
+		var authentication = new RecordingSessionAuthenticationProvider(isValid ? validatedUser : null);
+		var publisher = new CapturingPublisher(message => ReplySuccess((ClientMessage.WriteRequestMessage)message));
+		var response = new CapturingStreamWriter<Proto.LeaderFrame>();
+		var service = new ForwardingService(publisher, new CapturingAuthorizationProvider(), authentication);
+
+		await service.Forward(new EnumerableStreamReader<Proto.FollowerFrame>([
+			OpenFrame(), WriteEventsFrame(sessionUser), WriteEventsFrame(sessionUser)
+		]), response, new TestServerCallContext(certificate));
+
+		Assert.That(authentication.CallCount, Is.EqualTo(2));
+		Assert.That(authentication.Principal!.Identity!.Name, Is.EqualTo("writer"));
+		Assert.That(authentication.Principal.FindFirst("es:session-security-stamp")!.Value, Is.EqualTo(stamp.ToString("N")));
+		Assert.That(authentication.Principal.IsInRole("$admins"), Is.False);
+		if (isValid)
+		{
+			Assert.That(publisher.Messages.Cast<ClientMessage.WriteEvents>().Select(message => message.User),
+				Is.All.SameAs(validatedUser));
+			Assert.That(publisher.Messages.Cast<ClientMessage.WriteEvents>().Select(message => message.Tokens), Is.All.Null);
+		}
+		else
+		{
+			Assert.That(publisher.Messages, Is.Empty);
+			Assert.That(response.Messages.Select(message => message.Response.PayloadCase),
+				Is.All.EqualTo(Proto.ForwardResponse.PayloadOneofCase.NotAuthenticated));
+		}
+	}
+
+	[TestCase(false)]
+	[TestCase(true)]
+	public async Task session_identity_requires_mutual_tls_and_system_identity(bool useNonSystemCertificate)
+	{
+		using var certificate = useNonSystemCertificate ? CreateCertificate("user") : null;
+		var sessionUser = new ClaimsPrincipal(new LocalSessionClaimsIdentity([
+			new Claim(ClaimTypes.Name, "writer"), new Claim("es:session-security-stamp", Guid.NewGuid().ToString("N"))
+		]));
+		var authentication = new RecordingSessionAuthenticationProvider(sessionUser);
+		var publisher = new CapturingPublisher();
+		var response = new CapturingStreamWriter<Proto.LeaderFrame>();
+		var service = new ForwardingService(publisher, new CapturingAuthorizationProvider(), authentication);
+		var context = new TestServerCallContext(certificate);
+		if (useNonSystemCertificate)
+		{
+			context.GetHttpContext().User = sessionUser;
+		}
+
+		await service.Forward(new EnumerableStreamReader<Proto.FollowerFrame>([
+			OpenFrame(), WriteEventsFrame(sessionUser)
+		]), response, context);
+
+		Assert.That(authentication.CallCount, Is.Zero);
+		Assert.That(publisher.Messages, Is.Empty);
+		Assert.That(response.Messages.Single().Response.PayloadCase, Is.EqualTo(Proto.ForwardResponse.PayloadOneofCase.NotAuthenticated));
+	}
+
 	[TestCase(AuthenticationOutcome.Unauthorized, Proto.ForwardResponse.PayloadOneofCase.NotAuthenticated)]
 	[TestCase(AuthenticationOutcome.Error, Proto.ForwardResponse.PayloadOneofCase.NotAuthenticated)]
 	[TestCase(AuthenticationOutcome.NotReady, Proto.ForwardResponse.PayloadOneofCase.NotHandled)]
@@ -730,6 +796,23 @@ public enum AuthenticationOutcome
 		NotReady
 	}
 
+	private sealed class RecordingSessionAuthenticationProvider(ClaimsPrincipal? validated) :
+		AuthenticationProviderBase(name: "test"), ISessionAuthenticationProvider
+	{
+		public int CallCount { get; private set; }
+		public ClaimsPrincipal? Principal { get; private set; }
+		public void AuthenticateSession(AuthenticationRequest authenticationRequest) =>
+			Assert.Fail("Session validation must not authenticate new credentials.");
+		public override void Authenticate(AuthenticationRequest authenticationRequest) =>
+			Assert.Fail("Session validation must not use public credential authentication.");
+		public Task<ClaimsPrincipal> ValidateSessionAsync(ClaimsPrincipal principal, CancellationToken cancellationToken)
+		{
+			CallCount++;
+			Principal = principal;
+			return Task.FromResult(validated!);
+		}
+	}
+
 	private sealed class RecordingAuthenticationProvider(
 		ClaimsPrincipal? principal = null,
 		AuthenticationOutcome outcome = AuthenticationOutcome.Authenticated) : AuthenticationProviderBase(name: "test")
diff --git a/src/EventStore.Core/Authentication/CompositeAuthenticationProvider.cs b/src/EventStore.Core/Authentication/CompositeAuthenticationProvider.cs
index 9f8ba6a771..86d1325a6d 100644
--- a/src/EventStore.Core/Authentication/CompositeAuthenticationProvider.cs
+++ b/src/EventStore.Core/Authentication/CompositeAuthenticationProvider.cs
@@ -1,6 +1,8 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Security.Claims;
+using System.Threading;
 using System.Threading.Tasks;
 using EventStore.Plugins.Authentication;
 using Microsoft.AspNetCore.Builder;
@@ -11,8 +13,22 @@
 namespace EventStore.Core.Authentication;
 
 public class CompositeAuthenticationProvider(IReadOnlyList<IAuthenticationProvider> providers)
-	: AuthenticationProviderBase(name: "methods", diagnosticsName: "CompositeAuthentication")
+	: AuthenticationProviderBase(name: "methods", diagnosticsName: "CompositeAuthentication"), ISessionAuthenticationProvider
 {
+	public void AuthenticateSession(AuthenticationRequest authenticationRequest)
+	{
+		var provider = providers.FirstOrDefault(candidate =>
+			candidate.GetSupportedAuthenticationSchemes()?.Contains("Basic", StringComparer.OrdinalIgnoreCase) == true);
+		if (provider is ISessionAuthenticationProvider sessions)
+			sessions.AuthenticateSession(authenticationRequest);
+		else
+			authenticationRequest.Unauthorized();
+	}
+
+	public Task<ClaimsPrincipal> ValidateSessionAsync(ClaimsPrincipal principal, CancellationToken cancellationToken) =>
+		providers.OfType<ISessionAuthenticationProvider>().FirstOrDefault()?.ValidateSessionAsync(principal, cancellationToken)
+		?? Task.FromResult<ClaimsPrincipal>(null);
+
 	public override Task Initialize() =>
 		Task.WhenAll(providers.Select(provider => provider.Initialize()));
 
diff --git a/src/EventStore.Core/Authentication/DelegatedAuthentication/DelegatedAuthenticationProvider.cs b/src/EventStore.Core/Authentication/DelegatedAuthentication/DelegatedAuthenticationProvider.cs
index 6f6b34fb78..63ecff7114 100644
--- a/src/EventStore.Core/Authentication/DelegatedAuthentication/DelegatedAuthenticationProvider.cs
+++ b/src/EventStore.Core/Authentication/DelegatedAuthentication/DelegatedAuthenticationProvider.cs
@@ -1,6 +1,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Security.Claims;
+using System.Threading;
 using System.Threading.Tasks;
 using EventStore.Plugins.Authentication;
 using Microsoft.AspNetCore.Builder;
@@ -16,10 +17,23 @@ public class DelegatedAuthenticationProvider(IAuthenticationProvider inner) : Au
 	Version = inner.Version,
 	DiagnosticsName = inner.DiagnosticsName,
 	DiagnosticsTags = inner.DiagnosticsTags
-})
+}), ISessionAuthenticationProvider
 {
 	public IAuthenticationProvider Inner { get; } = inner;
 
+	public void AuthenticateSession(AuthenticationRequest authenticationRequest)
+	{
+		if (Inner is ISessionAuthenticationProvider provider)
+			provider.AuthenticateSession(authenticationRequest);
+		else
+			authenticationRequest.Unauthorized();
+	}
+
+	public Task<ClaimsPrincipal> ValidateSessionAsync(ClaimsPrincipal principal, CancellationToken cancellationToken) =>
+		Inner is ISessionAuthenticationProvider provider
+			? provider.ValidateSessionAsync(principal, cancellationToken)
+			: Task.FromResult<ClaimsPrincipal>(null);
+
 	public override Task Initialize() => Inner.Initialize();
 
 	public override void Authenticate(AuthenticationRequest authenticationRequest) =>
diff --git a/src/EventStore.Core/Authentication/ISessionAuthenticationProvider.cs b/src/EventStore.Core/Authentication/ISessionAuthenticationProvider.cs
new file mode 100644
index 0000000000..f9e3909c56
--- /dev/null
+++ b/src/EventStore.Core/Authentication/ISessionAuthenticationProvider.cs
@@ -0,0 +1,12 @@
+using System.Security.Claims;
+using System.Threading;
+using System.Threading.Tasks;
+using EventStore.Plugins.Authentication;
+
+namespace EventStore.Core.Authentication;
+
+public interface ISessionAuthenticationProvider
+{
+	void AuthenticateSession(AuthenticationRequest authenticationRequest);
+	Task<ClaimsPrincipal> ValidateSessionAsync(ClaimsPrincipal principal, CancellationToken cancellationToken);
+}
diff --git a/src/EventStore.Core/Authentication/InternalAuthentication/InternalAuthenticationProvider.cs b/src/EventStore.Core/Authentication/InternalAuthentication/InternalAuthenticationProvider.cs
index 629bcfaa5c..f17c453509 100644
--- a/src/EventStore.Core/Authentication/InternalAuthentication/InternalAuthenticationProvider.cs
+++ b/src/EventStore.Core/Authentication/InternalAuthentication/InternalAuthenticationProvider.cs
@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Security.Claims;
+using System.Threading;
 using System.Threading.Tasks;
 using EventStore.Common.Utils;
 using EventStore.Core.Bus;
@@ -15,8 +16,9 @@
 
 namespace EventStore.Core.Authentication.InternalAuthentication;
 
-public class InternalAuthenticationProvider : AuthenticationProviderBase, IHandle<InternalAuthenticationProviderMessages.ResetPasswordCache>
+public class InternalAuthenticationProvider : AuthenticationProviderBase, IHandle<InternalAuthenticationProviderMessages.ResetPasswordCache>, ISessionAuthenticationProvider
 {
+	public const string SessionSecurityStampClaimType = "es:session-security-stamp";
 	static readonly ILogger Logger = Serilog.Log.ForContext<InternalAuthenticationProvider>();
 
 	readonly IODispatcher _ioDispatcher;
@@ -72,22 +74,24 @@ public override void Authenticate(AuthenticationRequest authenticationRequest)
 		}
 		else
 		{
-			var userStreamId = $"$user-{authenticationRequest.Name}";
-			_ioDispatcher.ReadBackward(
-				streamId: userStreamId,
-				fromEventNumber: -1,
-				maxCount: 1,
-				resolveLinks: false,
-				principal: SystemAccounts.System,
-				handler: new AuthReadResponseHandler(self: this, request: authenticationRequest),
-				corrId: Guid.NewGuid()
-			);
+			AuthenticateSession(authenticationRequest);
 		}
 	}
 
+	public void AuthenticateSession(AuthenticationRequest authenticationRequest) =>
+		_ioDispatcher.ReadBackward(
+			streamId: $"$user-{authenticationRequest.Name}",
+			fromEventNumber: -1,
+			maxCount: 1,
+			resolveLinks: false,
+			principal: SystemAccounts.System,
+			handler: new AuthReadResponseHandler(self: this, request: authenticationRequest),
+			corrId: Guid.NewGuid()
+		);
+
 	public override IReadOnlyList<string> GetSupportedAuthenticationSchemes() => ["Basic", "UserCertificate"];
 
-	void AuthenticateUncached(AuthenticationRequest authenticationRequest, UserData userData)
+	void AuthenticateUncached(AuthenticationRequest authenticationRequest, UserData userData, Guid userEventId)
 	{
 		if (!AuthenticateImpl(authenticationRequest, userData.Hash, userData.Salt))
 		{
@@ -95,21 +99,78 @@ void AuthenticateUncached(AuthenticationRequest authenticationRequest, UserData
 			return;
 		}
 
-		var principal = CreatePrincipal(userData);
+		var principal = CreatePrincipal(userData, userEventId);
 		CachePassword(authenticationRequest.Name, userData.Hash, userData.Salt, principal);
 		authenticationRequest.Authenticated(principal);
 	}
 
-	static ClaimsPrincipal CreatePrincipal(UserData userData)
+	static ClaimsPrincipal CreatePrincipal(UserData userData, Guid userEventId)
 	{
 		var claims = userData.Groups
 			.Select(role => new Claim(ClaimTypes.Role, role))
 			.Prepend(new(ClaimTypes.Name, userData.LoginName))
+			.Append(new Claim(SessionSecurityStampClaimType, userEventId.ToString("N")))
 			.ToList();
 
 		return new(new ClaimsIdentity(claims, "ES-Legacy"));
 	}
 
+	public async Task<ClaimsPrincipal> ValidateSessionAsync(ClaimsPrincipal principal, CancellationToken cancellationToken)
+	{
+		var loginName = principal?.Identity?.Name;
+		var stamp = principal?.FindFirst(SessionSecurityStampClaimType)?.Value;
+		if (principal?.Identity?.IsAuthenticated != true || string.IsNullOrWhiteSpace(loginName) ||
+			!Guid.TryParseExact(stamp, "N", out var userEventId) || userEventId == Guid.Empty || cancellationToken.IsCancellationRequested)
+		{
+			return null;
+		}
+
+		var completion = new TaskCompletionSource<ClaimsPrincipal>(TaskCreationOptions.RunContinuationsAsynchronously);
+		_ioDispatcher.ReadBackward($"$user-{loginName}", -1, 1, false, SystemAccounts.System,
+			new SessionReadResponseHandler(loginName, userEventId, completion), Guid.NewGuid());
+		try
+		{
+			return await completion.Task.WaitAsync(TimeSpan.FromSeconds(5), cancellationToken);
+		}
+		catch (Exception exception) when (exception is TimeoutException or OperationCanceledException)
+		{
+			return null;
+		}
+	}
+
+	sealed class SessionReadResponseHandler(string loginName, Guid userEventId, TaskCompletionSource<ClaimsPrincipal> completion)
+		: IReadStreamEventsBackwardHandler
+	{
+		public bool HandlesAlt => true;
+		public bool HandlesTimeout => true;
+
+		public void Handle(ClientMessage.ReadStreamEventsBackwardCompleted completed)
+		{
+			ClaimsPrincipal principal = null;
+			try
+			{
+				if (completed.Result == ReadStreamResult.Success && completed.Events.Count == 1 &&
+					completed.Events[0].Event.EventId == userEventId)
+				{
+					var userData = completed.Events[0].Event.Data.ParseJson<UserData>();
+					if (userData.LoginName == loginName && !userData.Disabled)
+					{
+						principal = new ClaimsPrincipal(new LocalSessionClaimsIdentity(CreatePrincipal(userData, userEventId).Claims));
+					}
+				}
+			}
+			catch
+			{
+				principal = null;
+			}
+
+			completion.TrySetResult(principal);
+		}
+
+		public void Handle(ClientMessage.NotHandled notHandled) => completion.TrySetResult(null);
+		public void Timeout() => completion.TrySetResult(null);
+	}
+
 	void CachePassword(string loginName, string hash, string salt, ClaimsPrincipal principal) =>
 		_userPasswordsCache.Put(loginName, (hash, salt, principal));
 
@@ -200,7 +261,7 @@ public void Handle(ClientMessage.ReadStreamEventsBackwardCompleted completed)
 				}
 				else
 				{
-					self.AuthenticateUncached(request, userData);
+					self.AuthenticateUncached(request, userData, completed.Events[0].Event.EventId);
 				}
 			}
 			catch
diff --git a/src/EventStore.Core/Authentication/LocalSessionClaimsIdentity.cs b/src/EventStore.Core/Authentication/LocalSessionClaimsIdentity.cs
new file mode 100644
index 0000000000..c7dbcbf8c6
--- /dev/null
+++ b/src/EventStore.Core/Authentication/LocalSessionClaimsIdentity.cs
@@ -0,0 +1,6 @@
+using System.Collections.Generic;
+using System.Security.Claims;
+
+namespace EventStore.Core.Authentication;
+
+public sealed class LocalSessionClaimsIdentity(IEnumerable<Claim> claims) : ClaimsIdentity(claims, "ES-Legacy");
diff --git a/src/EventStore.Core/ClusterVNodeStartup.cs b/src/EventStore.Core/ClusterVNodeStartup.cs
index 904a3c963d..269f487407 100644
--- a/src/EventStore.Core/ClusterVNodeStartup.cs
+++ b/src/EventStore.Core/ClusterVNodeStartup.cs
@@ -207,8 +207,12 @@ public void ConfigureServicesOnly(IServiceCollection services)
 
 		services = services
 			.AddRouting()
-			.AddAuthentication(o => o
-				.AddScheme<EventStoreAuthenticationHandler>("es auth", displayName: null))
+			.AddAuthentication(o =>
+			{
+				o.DefaultAuthenticateScheme = "es auth";
+				o.DefaultChallengeScheme = "es auth";
+				o.AddScheme<EventStoreAuthenticationHandler>("es auth", displayName: null);
+			})
 			.Services
 			.AddAuthorization()
 			.AddAntiforgery()
diff --git a/src/EventStore.Core/Services/Transport/Grpc/Forwarding/ForwardingGrpcCodec.cs b/src/EventStore.Core/Services/Transport/Grpc/Forwarding/ForwardingGrpcCodec.cs
index d5ca14c881..be24786c2e 100644
--- a/src/EventStore.Core/Services/Transport/Grpc/Forwarding/ForwardingGrpcCodec.cs
+++ b/src/EventStore.Core/Services/Transport/Grpc/Forwarding/ForwardingGrpcCodec.cs
@@ -7,6 +7,7 @@
 using EventStore.Common.Utils;
 using EventStore.Core.Authentication;
 using EventStore.Core.Authentication.DelegatedAuthentication;
+using EventStore.Core.Authentication.InternalAuthentication;
 using EventStore.Core.Data;
 using EventStore.Core.Messages;
 using EventStore.Core.Messaging;
@@ -25,6 +26,7 @@ private ForwardingIdentity()
 	public sealed record TrustedSystem : ForwardingIdentity;
 	public sealed record BearerToken(string Token) : ForwardingIdentity;
 	public sealed record UserPassword(string Username, string Password) : ForwardingIdentity;
+	public sealed record LocalSession(string Username, Guid UserEventId) : ForwardingIdentity;
 	public sealed record Anonymous : ForwardingIdentity;
 }
 
@@ -84,12 +86,14 @@ public static Proto.FollowerFrame ToGrpc(
 		Proto.ForwardedIdentity.IdentityOneofCase.UserPassword =>
 			new ForwardingIdentity.UserPassword(identity.UserPassword.Username, identity.UserPassword.Password),
 		Proto.ForwardedIdentity.IdentityOneofCase.Anonymous => new ForwardingIdentity.Anonymous(),
+		Proto.ForwardedIdentity.IdentityOneofCase.LocalSession => new ForwardingIdentity.LocalSession(
+			identity.LocalSession.Username, Uuid.FromDto(identity.LocalSession.UserEventId).ToGuid()),
 		_ => throw new ArgumentOutOfRangeException(nameof(identity), identity.IdentityCase,
 			"Unknown forwarded identity")
 	};
 
 	public static bool RequiresTls(ClientMessage.WriteRequestMessage message) =>
-		GetIdentity(message) is ForwardingIdentity.BearerToken or ForwardingIdentity.UserPassword;
+		GetIdentity(message) is ForwardingIdentity.BearerToken or ForwardingIdentity.UserPassword or ForwardingIdentity.LocalSession;
 
 	public static ClientMessage.WriteRequestMessage FromGrpc(
 		Proto.ForwardRequest request,
@@ -268,7 +272,7 @@ private static Proto.ForwardedIdentity ToGrpcIdentity(
 		}
 
 		var identity = GetIdentity(message);
-		if (identity is ForwardingIdentity.BearerToken or ForwardingIdentity.UserPassword)
+		if (identity is ForwardingIdentity.BearerToken or ForwardingIdentity.UserPassword or ForwardingIdentity.LocalSession)
 		{
 			EnsureCredentialsAreProtected(transportSecurity);
 		}
@@ -295,6 +299,14 @@ private static Proto.ForwardedIdentity ToGrpcIdentity(
 			{
 				Anonymous = new Google.Protobuf.WellKnownTypes.Empty()
 			},
+			ForwardingIdentity.LocalSession session => new Proto.ForwardedIdentity
+			{
+				LocalSession = new Proto.LocalSession
+				{
+					Username = session.Username,
+					UserEventId = Uuid.FromGuid(session.UserEventId).ToDto()
+				}
+			},
 			_ => throw new ArgumentOutOfRangeException(nameof(identity), identity.GetType().FullName,
 				"Unknown forwarding identity")
 		};
@@ -322,6 +334,13 @@ private static ForwardingIdentity GetIdentity(ClientMessage.WriteRequestMessage
 					return new ForwardingIdentity.UserPassword(uid.Value, pwd.Value);
 				}
 			}
+
+			if (message.User.Identities.OfType<LocalSessionClaimsIdentity>().FirstOrDefault() is { Name.Length: > 0 } localSession &&
+				Guid.TryParseExact(localSession.FindFirst(InternalAuthenticationProvider.SessionSecurityStampClaimType)?.Value,
+					"N", out var userEventId) && userEventId != Guid.Empty)
+			{
+				return new ForwardingIdentity.LocalSession(localSession.Name, userEventId);
+			}
 		}
 
 		return message.Login is not null && message.Password is not null
diff --git a/src/EventStore.Core/Services/Transport/Grpc/Forwarding/ForwardingService.cs b/src/EventStore.Core/Services/Transport/Grpc/Forwarding/ForwardingService.cs
index 397e014ccb..39b5ef358d 100644
--- a/src/EventStore.Core/Services/Transport/Grpc/Forwarding/ForwardingService.cs
+++ b/src/EventStore.Core/Services/Transport/Grpc/Forwarding/ForwardingService.cs
@@ -7,6 +7,7 @@
 using System.Threading.Channels;
 using System.Threading.Tasks;
 using EventStore.Core.Authentication;
+using EventStore.Core.Authentication.InternalAuthentication;
 using EventStore.Core.Authorization;
 using EventStore.Core.Bus;
 using EventStore.Core.DataStructures;
@@ -221,6 +222,8 @@ private async Task<ForwardedAuthentication> AuthenticateAsync(
 				return ForwardedAuthentication.Authenticated(SystemAccounts.System, null);
 			case ForwardingIdentity.Anonymous:
 				return ForwardedAuthentication.Authenticated(SystemAccounts.Anonymous, null);
+			case ForwardingIdentity.LocalSession session:
+				return await AuthenticateSessionAsync(session, context).ConfigureAwait(false);
 			case ForwardingIdentity.BearerToken bearer:
 				return await AuthenticateCredentialsAsync(
 					context,
@@ -239,6 +242,36 @@ private async Task<ForwardedAuthentication> AuthenticateAsync(
 		}
 	}
 
+	private async Task<ForwardedAuthentication> AuthenticateSessionAsync(
+		ForwardingIdentity.LocalSession session,
+		ServerCallContext context)
+	{
+		var httpContext = context.GetHttpContext();
+		if (!httpContext.Request.IsHttps || httpContext.Connection.ClientCertificate is null ||
+			httpContext.User != SystemAccounts.System ||
+			string.IsNullOrWhiteSpace(session.Username) || session.UserEventId == Guid.Empty ||
+			_authenticationProvider is not ISessionAuthenticationProvider provider)
+		{
+			return ForwardedAuthentication.NotAuthenticated("Invalid session authentication.");
+		}
+
+		var principal = new ClaimsPrincipal(new ClaimsIdentity([
+			new Claim(ClaimTypes.Name, session.Username),
+			new Claim(InternalAuthenticationProvider.SessionSecurityStampClaimType, session.UserEventId.ToString("N"))
+		], "ES-SessionForwarding"));
+		try
+		{
+			var validated = await provider.ValidateSessionAsync(principal, context.CancellationToken).ConfigureAwait(false);
+			return validated is null
+				? ForwardedAuthentication.NotAuthenticated("Invalid session authentication.")
+				: ForwardedAuthentication.Authenticated(validated, null);
+		}
+		catch (Exception exception) when (exception is not OperationCanceledException)
+		{
+			return ForwardedAuthentication.NotAuthenticated("Session authentication failed.");
+		}
+	}
+
 	private async Task<ForwardedAuthentication> AuthenticateCredentialsAsync(
 		ServerCallContext context,
 		IReadOnlyDictionary<string, string> tokens)
diff --git a/src/EventStore.Core/Services/Transport/Http/AuthenticationMiddleware.cs b/src/EventStore.Core/Services/Transport/Http/AuthenticationMiddleware.cs
index 76a06c3331..8f1c8162ec 100644
--- a/src/EventStore.Core/Services/Transport/Http/AuthenticationMiddleware.cs
+++ b/src/EventStore.Core/Services/Transport/Http/AuthenticationMiddleware.cs
@@ -14,11 +14,14 @@ public class AuthenticationMiddleware : IMiddleware
 {
 	private readonly IAuthenticationProvider _authenticationProvider;
 	private readonly IReadOnlyList<IHttpAuthenticationProvider> _httpAuthenticationProviders;
+	private readonly IUiSessionAuthenticator _uiSessionAuthenticator;
 
-	public AuthenticationMiddleware(IReadOnlyList<IHttpAuthenticationProvider> httpAuthenticationProviders, IAuthenticationProvider authenticationProvider)
+	public AuthenticationMiddleware(IReadOnlyList<IHttpAuthenticationProvider> httpAuthenticationProviders, IAuthenticationProvider authenticationProvider,
+		IUiSessionAuthenticator uiSessionAuthenticator = null)
 	{
 		_httpAuthenticationProviders = httpAuthenticationProviders;
 		_authenticationProvider = authenticationProvider;
+		_uiSessionAuthenticator = uiSessionAuthenticator;
 	}
 
 	public async Task InvokeAsync(HttpContext context, RequestDelegate next)
@@ -42,6 +45,24 @@ public async Task InvokeAsync(HttpContext context, RequestDelegate next)
 
 	private async Task HandleAsHttpAsync(HttpContext context, RequestDelegate next)
 	{
+		if (_uiSessionAuthenticator is not null &&
+			context.Request.Path.StartsWithSegments("/ui") &&
+			!context.Request.Headers.ContainsKey("Authorization"))
+		{
+			var sessionPrincipal = await _uiSessionAuthenticator.AuthenticateAsync(context);
+			if (sessionPrincipal?.Identity?.IsAuthenticated == true)
+			{
+				context.User = sessionPrincipal;
+				if (!await _uiSessionAuthenticator.ValidateRequestAsync(context))
+				{
+					context.Response.StatusCode = StatusCodes.Status400BadRequest;
+					return;
+				}
+				await next(context);
+				return;
+			}
+		}
+
 		if (!TrySelectProvider(context, out var authenticationRequest))
 		{
 			await AddHttp1ChallengeHeaders(context);
diff --git a/src/EventStore.Core/Services/Transport/Http/IUiSessionAuthenticator.cs b/src/EventStore.Core/Services/Transport/Http/IUiSessionAuthenticator.cs
new file mode 100644
index 0000000000..e4d568b5a1
--- /dev/null
+++ b/src/EventStore.Core/Services/Transport/Http/IUiSessionAuthenticator.cs
@@ -0,0 +1,11 @@
+using System.Security.Claims;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Http;
+
+namespace EventStore.Core.Services.Transport.Http;
+
+public interface IUiSessionAuthenticator
+{
+	Task<ClaimsPrincipal> AuthenticateAsync(HttpContext context);
+	Task<bool> ValidateRequestAsync(HttpContext context);
+}
diff --git a/src/Protos/Grpc/forwarding.proto b/src/Protos/Grpc/forwarding.proto
index 0c9d9161cb..621ceb77d4 100644
--- a/src/Protos/Grpc/forwarding.proto
+++ b/src/Protos/Grpc/forwarding.proto
@@ -44,9 +44,15 @@ message ForwardedIdentity {
 		string bearer_token = 2;
 		UserPassword user_password = 3;
 		google.protobuf.Empty anonymous = 4;
+		LocalSession local_session = 5;
 	}
 }
 
+message LocalSession {
+	string username = 1;
+	event_store.client.UUID user_event_id = 2;
+}
+
 message UserPassword {
 	string username = 1;
 	string password = 2;

From 9e19e71754557e5648faf4c95d98073d4cead95a Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Sat, 5 Sep 2026 01:27:49 -0400
Subject: [PATCH 2/2] fix(security): fail safely at browser authentication
 boundaries

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
---
 .../Services/OAuthBrowserFlowEndpoints.cs     |  26 +++--
 .../Services/SecurityBrowserService.cs        |  11 +-
 .../Services/UiSessionAuthentication.cs       |   1 +
 .../OAuthBrowserFlowServiceTests.cs           | 104 ++++++++++++++++++
 .../SecurityBrowserServiceTests.cs            |  54 +++++++++
 .../UiSessionIntegrationTests.cs              |  42 ++++++-
 .../Grpc/Forwarding/ForwardingServiceTests.cs |   2 +
 .../Configuration/ClusterVNodeOptionsTests.cs |  51 +++++++++
 .../Configuration/ClusterVNodeOptions.cs      |  39 ++++++-
 9 files changed, 315 insertions(+), 15 deletions(-)

diff --git a/src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs b/src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs
index cef739ed23..dc4bf2d952 100644
--- a/src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs
+++ b/src/EventStore.ClusterNode/Components/Services/OAuthBrowserFlowEndpoints.cs
@@ -27,7 +27,7 @@ public static IEndpointRouteBuilder MapOAuthBrowserFlowEndpoints(
 		ClusterVNodeOptions.OAuthOptions options)
 	{
 		app.MapGet(options.CodeChallengePath, (HttpContext context, OAuthBrowserFlowService service) =>
-			Results.Json(service.CreateCodeChallenge(context), OAuthBrowserFlowService.JsonOptions));
+			service.HandleCodeChallenge(context));
 
 		app.MapGet(options.RedirectPath, async (
 			HttpContext context,
@@ -51,8 +51,16 @@ public sealed class OAuthBrowserFlowService(
 	private static readonly TimeSpan ChallengeLifetime = TimeSpan.FromMinutes(5);
 	private readonly IDataProtector _challengeProtector = dataProtectionProvider.CreateProtector("EventStore.ClusterNode.Components.Services.OAuthBrowserFlowService.Pkce");
 
+	public IResult HandleCodeChallenge(HttpContext context) =>
+		context.Request.IsHttps
+			? Results.Json(CreateCodeChallenge(context), JsonOptions)
+			: ErrorRedirect("https_required", "");
+
 	public OAuthCodeChallenge CreateCodeChallenge(HttpContext context)
 	{
+		if (!context.Request.IsHttps)
+			throw new InvalidOperationException("OAuth browser authentication requires HTTPS.");
+
 		var verifier = Base64Url(RandomNumberGenerator.GetBytes(32));
 		var challenge = Base64Url(SHA256.HashData(Encoding.ASCII.GetBytes(verifier)));
 		var correlationId = Base64Url(RandomNumberGenerator.GetBytes(32));
@@ -61,7 +69,7 @@ public OAuthCodeChallenge CreateCodeChallenge(HttpContext context)
 		context.Response.Cookies.Append(
 			ChallengeCookieName,
 			_challengeProtector.Protect(JsonSerializer.Serialize(payload, JsonOptions)),
-			ChallengeCookieOptions(context.Request));
+			ChallengeCookieOptions(ChallengeLifetime));
 		return new OAuthCodeChallenge(correlationId, challenge, "S256");
 	}
 
@@ -243,6 +251,8 @@ private bool TryReadState(string state, out string correlationId, out string ret
 			if (document.RootElement.TryGetProperty("redirect_uri", out var redirectUriElement))
 			{
 				redirectUri = NormalizeRedirectUri(redirectUriElement.GetString() ?? "");
+				if (string.IsNullOrWhiteSpace(redirectUri))
+					return false;
 			}
 
 			return !string.IsNullOrWhiteSpace(correlationId);
@@ -265,8 +275,7 @@ private string NormalizeRedirectUri(string redirectUri)
 			return "";
 		}
 
-		if (!uri.Scheme.Equals(Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase) &&
-			!uri.Scheme.Equals(Uri.UriSchemeHttp, StringComparison.OrdinalIgnoreCase))
+		if (!uri.Scheme.Equals(Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase))
 		{
 			return "";
 		}
@@ -289,15 +298,12 @@ private static string DirectReturnLocation(string returnUrl) =>
 			: returnUrl;
 
 	private void DeleteChallengeCookie(HttpContext context) =>
-		context.Response.Cookies.Delete(ChallengeCookieName, ChallengeCookieOptions(context.Request, maxAge: null));
-
-	private CookieOptions ChallengeCookieOptions(HttpRequest request) =>
-		ChallengeCookieOptions(request, ChallengeLifetime);
+		context.Response.Cookies.Delete(ChallengeCookieName, ChallengeCookieOptions(maxAge: null));
 
-	private CookieOptions ChallengeCookieOptions(HttpRequest request, TimeSpan? maxAge) => new()
+	private static CookieOptions ChallengeCookieOptions(TimeSpan? maxAge) => new()
 	{
 		HttpOnly = true,
-		Secure = request.IsHttps,
+		Secure = true,
 		SameSite = SameSiteMode.Lax,
 		Path = "/",
 		MaxAge = maxAge
diff --git a/src/EventStore.ClusterNode/Components/Services/SecurityBrowserService.cs b/src/EventStore.ClusterNode/Components/Services/SecurityBrowserService.cs
index cae991f1d3..fd88b8301f 100644
--- a/src/EventStore.ClusterNode/Components/Services/SecurityBrowserService.cs
+++ b/src/EventStore.ClusterNode/Components/Services/SecurityBrowserService.cs
@@ -56,7 +56,16 @@ public async Task<SecurityCommandResult> SignInAsync(HttpContext context, string
 
 		var request = new HttpAuthenticationRequest(context, username.Trim(), password);
 		sessions.AuthenticateSession(request);
-		var (status, principal) = await request.AuthenticateAsync().WaitAsync(TimeSpan.FromSeconds(5), context.RequestAborted);
+		HttpAuthenticationRequestStatus status;
+		ClaimsPrincipal principal;
+		try
+		{
+			(status, principal) = await request.AuthenticateAsync().WaitAsync(TimeSpan.FromSeconds(5), context.RequestAborted);
+		}
+		catch (TimeoutException)
+		{
+			return SecurityCommandResult.Failure("The authentication provider is not ready yet.");
+		}
 		if (status == HttpAuthenticationRequestStatus.Authenticated)
 		{
 			var current = await sessions.ValidateSessionAsync(principal, context.RequestAborted);
diff --git a/src/EventStore.ClusterNode/Components/Services/UiSessionAuthentication.cs b/src/EventStore.ClusterNode/Components/Services/UiSessionAuthentication.cs
index 5dfeb1cd52..aeed068239 100644
--- a/src/EventStore.ClusterNode/Components/Services/UiSessionAuthentication.cs
+++ b/src/EventStore.ClusterNode/Components/Services/UiSessionAuthentication.cs
@@ -135,6 +135,7 @@ public override async Task ValidatePrincipal(CookieValidatePrincipalContext cont
 		else if (ticket is not null && authenticationProvider is ISessionAuthenticationProvider sessions)
 		{
 			principal = await sessions.ValidateSessionAsync(ticket.Principal, context.HttpContext.RequestAborted);
+			context.HttpContext.RequestAborted.ThrowIfCancellationRequested();
 		}
 
 		if (principal?.Identity?.IsAuthenticated != true)
diff --git a/src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs b/src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs
index 560c622d68..070dea30db 100644
--- a/src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs
+++ b/src/EventStore.Core.Tests/Authentication/OAuthBrowserFlowServiceTests.cs
@@ -13,9 +13,13 @@
 using EventStore.Core.Authentication.OAuth;
 using EventStore.Plugins.Authentication;
 using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.DataProtection;
+using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.TestHost;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Primitives;
 using Microsoft.IdentityModel.JsonWebTokens;
 using Microsoft.IdentityModel.Tokens;
@@ -55,6 +59,106 @@ public void TearDown()
 		_services.Dispose();
 	}
 
+	[TestCase(false, true)]
+	[TestCase(false, false)]
+	[TestCase(true, true)]
+	[TestCase(true, false)]
+	public async Task challenge_endpoint_requires_https(bool https, bool adminUiEnabled)
+	{
+		using var service = Service(new TokenHandler(), adminUiEnabled);
+		using var host = await new HostBuilder().ConfigureWebHost(web => web.UseTestServer()
+			.ConfigureServices(services =>
+			{
+				services.AddRouting();
+				services.AddSingleton(service);
+			})
+			.Configure(app =>
+			{
+				app.UseRouting();
+				app.UseEndpoints(endpoints => typeof(OAuthBrowserFlowService).Assembly
+					.GetType("EventStore.ClusterNode.Components.Services.OAuthBrowserFlowEndpoints")!
+					.GetMethod("MapOAuthBrowserFlowEndpoints")!.Invoke(null, [endpoints, Options()]));
+			})).StartAsync();
+		using var client = host.GetTestClient();
+		client.BaseAddress = new Uri(https ? "https://node.example.test" : "http://node.example.test");
+
+		using var response = await client.GetAsync(Options().CodeChallengePath);
+
+		if (https)
+		{
+			Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.OK));
+			Assert.That(response.Headers.GetValues("Set-Cookie").Single(), Does.Contain("secure"));
+			Assert.That(await response.Content.ReadAsStringAsync(), Does.Contain("code_challenge"));
+		}
+		else
+		{
+			Assert.That(response.StatusCode, Is.EqualTo(HttpStatusCode.Redirect));
+			Assert.That(response.Headers.Location?.OriginalString,
+				Is.EqualTo(adminUiEnabled ? "/ui/signin?oauth_error=https_required" : "/?oauth_error=https_required"));
+			Assert.That(response.Headers.Contains("Set-Cookie"), Is.False);
+		}
+	}
+
+	[Test]
+	public void challenge_service_rejects_http_without_issuing_pkce_cookie()
+	{
+		using var service = Service(new TokenHandler());
+		var context = HttpsContext();
+		context.Request.Scheme = "http";
+
+		Assert.That(() => service.CreateCodeChallenge(context), Throws.InvalidOperationException);
+		Assert.That(context.Response.Headers.SetCookie, Is.Empty);
+	}
+
+	[TestCase("http://node.example.test/ui/auth/oauth/callback")]
+	[TestCase("ftp://node.example.test/ui/auth/oauth/callback")]
+	public async Task callback_rejects_non_https_redirect_uri_without_exchanging_code(string redirectUri)
+	{
+		var handler = new TokenHandler();
+		using var service = Service(handler);
+		var challengeContext = HttpsContext();
+		var challenge = service.CreateCodeChallenge(challengeContext);
+		var context = HttpsContext();
+		context.Request.Headers.Cookie = challengeContext.Response.Headers.SetCookie.ToString().Split(';')[0];
+		context.Request.Query = new QueryCollection(new Dictionary<string, StringValues>
+		{
+			["code"] = "authorization-code",
+			["state"] = State(challenge.CodeChallengeCorrelationId, redirectUri)
+		});
+
+		var result = await service.HandleCallback(context, CancellationToken.None);
+		await result.ExecuteAsync(context);
+
+		Assert.That(context.Response.Headers.Location.ToString(), Does.Contain("oauth_error=invalid_state"));
+		Assert.That(handler.Body, Is.Empty);
+		Assert.That(context.Response.Headers.SetCookie.ToString(), Does.Not.Contain(UiSessionAuthentication.CookieName + "="));
+	}
+
+	[Test]
+	public async Task callback_without_redirect_uri_uses_https_request_uri()
+	{
+		var handler = new TokenHandler();
+		using var service = Service(handler);
+		var challengeContext = HttpsContext();
+		var challenge = service.CreateCodeChallenge(challengeContext);
+		var context = HttpsContext();
+		context.Request.Headers.Cookie = challengeContext.Response.Headers.SetCookie.ToString().Split(';')[0];
+		context.Request.Query = new QueryCollection(new Dictionary<string, StringValues>
+		{
+			["code"] = "authorization-code",
+			["state"] = Convert.ToBase64String(JsonSerializer.SerializeToUtf8Bytes(new
+			{
+				code_challenge_correlation_id = challenge.CodeChallengeCorrelationId
+			}))
+		});
+
+		var result = await service.HandleCallback(context, CancellationToken.None);
+		await result.ExecuteAsync(context);
+
+		Assert.That(context.Response.Headers.Location.ToString(), Is.EqualTo("/ui/signin"));
+		Assert.That(handler.Body, Does.Contain("redirect_uri=https%3A%2F%2Fnode.example.test%2Fui%2Fauth%2Foauth%2Fcallback"));
+	}
+
 	[Test]
 	public async Task callback_authentication_timeout_redirects_without_issuing_session()
 	{
diff --git a/src/EventStore.Core.Tests/Authentication/SecurityBrowserServiceTests.cs b/src/EventStore.Core.Tests/Authentication/SecurityBrowserServiceTests.cs
index a0b1a97ccc..04d02dcc54 100644
--- a/src/EventStore.Core.Tests/Authentication/SecurityBrowserServiceTests.cs
+++ b/src/EventStore.Core.Tests/Authentication/SecurityBrowserServiceTests.cs
@@ -1,6 +1,10 @@
+using System;
 using System.Collections.Generic;
 using System.Security.Claims;
+using System.Threading;
+using System.Threading.Tasks;
 using EventStore.ClusterNode.Components.Services;
+using EventStore.Core.Authentication;
 using EventStore.Plugins.Authentication;
 using Microsoft.AspNetCore.Http;
 using NUnit.Framework;
@@ -10,6 +14,37 @@ namespace EventStore.Core.Tests.Authentication;
 [TestFixture]
 public class SecurityBrowserServiceTests
 {
+	[Test]
+	public async Task password_sign_in_timeout_returns_not_ready_without_issuing_cookie()
+	{
+		var provider = new UnresponsiveSessionAuthenticationProvider();
+		var service = new SecurityBrowserService(provider, supportsPassword: true);
+		var context = new DefaultHttpContext();
+		context.Request.Scheme = "https";
+
+		var result = await service.SignInAsync(context, "test", "password");
+
+		Assert.That(result, Is.EqualTo(SecurityCommandResult.Failure("The authentication provider is not ready yet.")));
+		Assert.That(context.Response.Headers.SetCookie, Is.Empty);
+		Assert.That(provider.SessionValidationCalls, Is.Zero);
+	}
+
+	[Test]
+	public void password_sign_in_request_cancellation_propagates_without_issuing_cookie()
+	{
+		var provider = new UnresponsiveSessionAuthenticationProvider();
+		var service = new SecurityBrowserService(provider, supportsPassword: true);
+		using var cancellation = new CancellationTokenSource();
+		var context = new DefaultHttpContext { RequestAborted = cancellation.Token };
+		context.Request.Scheme = "https";
+		cancellation.Cancel();
+
+		Assert.That(async () => await service.SignInAsync(context, "test", "password"),
+			Throws.InstanceOf<OperationCanceledException>());
+		Assert.That(context.Response.Headers.SetCookie, Is.Empty);
+		Assert.That(provider.SessionValidationCalls, Is.Zero);
+	}
+
 	[Test]
 	public void does_not_enable_oauth_browser_flow_with_blank_scope()
 	{
@@ -51,6 +86,25 @@ public void enables_basic_when_password_authentication_is_configured()
 		Assert.That(info.SupportsBasic, Is.True);
 	}
 
+	private sealed class UnresponsiveSessionAuthenticationProvider()
+		: AuthenticationProviderBase(name: "test"), ISessionAuthenticationProvider
+	{
+		public int SessionValidationCalls { get; private set; }
+
+		public override IReadOnlyList<string> GetSupportedAuthenticationSchemes() => ["Basic"];
+
+		public override void Authenticate(AuthenticationRequest authenticationRequest) =>
+			throw new InvalidOperationException("Browser sign-in must use session authentication.");
+
+		public void AuthenticateSession(AuthenticationRequest authenticationRequest) { }
+
+		public Task<ClaimsPrincipal> ValidateSessionAsync(ClaimsPrincipal principal, CancellationToken cancellationToken)
+		{
+			SessionValidationCalls++;
+			return Task.FromResult<ClaimsPrincipal>(null);
+		}
+	}
+
 	private sealed class BrowserFlowAuthenticationProvider(
 		IReadOnlyList<KeyValuePair<string, string>> publicProperties,
 		IReadOnlyList<string> schemes = null)
diff --git a/src/EventStore.Core.Tests/Authentication/UiSessionIntegrationTests.cs b/src/EventStore.Core.Tests/Authentication/UiSessionIntegrationTests.cs
index dc0a36dd90..bdb5b85638 100644
--- a/src/EventStore.Core.Tests/Authentication/UiSessionIntegrationTests.cs
+++ b/src/EventStore.Core.Tests/Authentication/UiSessionIntegrationTests.cs
@@ -151,6 +151,45 @@ public async Task revoked_account_cannot_reuse_session_even_if_reenabled_later()
 		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("anonymous"));
 	}
 
+	[TestCase(true)]
+	[TestCase(false)]
+	public async Task cancelled_password_session_validation_does_not_revoke_cookie(bool alreadyCancelled)
+	{
+		var cookie = await Login();
+		using var cancellation = new CancellationTokenSource();
+		var validationStarted = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+		_provider.ValidateSession = async token =>
+		{
+			validationStarted.SetResult();
+			try
+			{
+				await Task.Delay(Timeout.InfiniteTimeSpan, token);
+			}
+			catch (OperationCanceledException)
+			{
+				return null;
+			}
+			return null;
+		};
+		using var scope = _server.Services.CreateScope();
+		var context = new DefaultHttpContext
+		{
+			RequestServices = scope.ServiceProvider,
+			RequestAborted = cancellation.Token
+		};
+		context.Request.Scheme = "https";
+		context.Request.Headers.Cookie = cookie;
+		if (alreadyCancelled)
+			cancellation.Cancel();
+		var authentication = context.AuthenticateAsync(UiSessionAuthentication.Scheme);
+		await validationStarted.Task.WaitAsync(TimeSpan.FromSeconds(5));
+		cancellation.Cancel();
+		Assert.That(async () => await authentication, Throws.InstanceOf<OperationCanceledException>());
+		Assert.That(context.Response.Headers.SetCookie, Is.Empty);
+		_provider.ValidateSession = null;
+		Assert.That(await _client.GetStringAsync("/ui/me"), Is.EqualTo("admin"));
+	}
+
 	[Test]
 	public async Task csrf_is_required_for_cookie_authenticated_mutations_and_logout_revokes_replay()
 	{
@@ -213,6 +252,7 @@ private sealed class SessionProvider : AuthenticationProviderBase, ISessionAuthe
 		public bool Valid = true;
 		public int PasswordChecks;
 		public int SessionChecks;
+		public Func<CancellationToken, Task<ClaimsPrincipal>> ValidateSession;
 		public SessionProvider() : base("test") { }
 		public void AuthenticateSession(AuthenticationRequest request)
 		{
@@ -229,7 +269,7 @@ public override void Authenticate(AuthenticationRequest request)
 				request.Unauthorized();
 		}
 		public Task<ClaimsPrincipal> ValidateSessionAsync(ClaimsPrincipal principal, CancellationToken cancellationToken) =>
-			Task.FromResult(Valid ? Principal() : null);
+			ValidateSession?.Invoke(cancellationToken) ?? Task.FromResult(Valid ? Principal() : null);
 		private static ClaimsPrincipal Principal() => new(new ClaimsIdentity([
 			new Claim(ClaimTypes.Name, "admin"), new Claim(ClaimTypes.Role, "$admins"),
 			new Claim(InternalAuthenticationProvider.SessionSecurityStampClaimType, "verified-revision")], "test"));
diff --git a/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingServiceTests.cs b/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingServiceTests.cs
index afe6a2a6fb..77178a636c 100644
--- a/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingServiceTests.cs
+++ b/src/EventStore.Core.Tests/Services/Transport/Grpc/Forwarding/ForwardingServiceTests.cs
@@ -268,6 +268,7 @@ await service.Forward(new EnumerableStreamReader<Proto.FollowerFrame>([
 		Assert.That(authentication.Principal.IsInRole("$admins"), Is.False);
 		if (isValid)
 		{
+			Assert.That(publisher.Messages, Has.Count.EqualTo(2));
 			Assert.That(publisher.Messages.Cast<ClientMessage.WriteEvents>().Select(message => message.User),
 				Is.All.SameAs(validatedUser));
 			Assert.That(publisher.Messages.Cast<ClientMessage.WriteEvents>().Select(message => message.Tokens), Is.All.Null);
@@ -275,6 +276,7 @@ await service.Forward(new EnumerableStreamReader<Proto.FollowerFrame>([
 		else
 		{
 			Assert.That(publisher.Messages, Is.Empty);
+			Assert.That(response.Messages, Has.Count.EqualTo(2));
 			Assert.That(response.Messages.Select(message => message.Response.PayloadCase),
 				Is.All.EqualTo(Proto.ForwardResponse.PayloadOneofCase.NotAuthenticated));
 		}
diff --git a/src/EventStore.Core.XUnit.Tests/Configuration/ClusterVNodeOptionsTests.cs b/src/EventStore.Core.XUnit.Tests/Configuration/ClusterVNodeOptionsTests.cs
index 58b55355b3..d9a3944c66 100644
--- a/src/EventStore.Core.XUnit.Tests/Configuration/ClusterVNodeOptionsTests.cs
+++ b/src/EventStore.Core.XUnit.Tests/Configuration/ClusterVNodeOptionsTests.cs
@@ -206,6 +206,57 @@ public void unknown_options_ignores_repeated_keys_from_other_sources()
 		options.Unknown.Options.Should().BeEmpty();
 	}
 
+	[Theory]
+	[InlineData("Auth:OAuth:IssuerTypo")]
+	[InlineData("Auth:MethodTypo")]
+	[InlineData("Auth:OAuth:Issuer:Unexpected")]
+	[InlineData("Auth:OAuth:Audiences:0:Unexpected")]
+	[InlineData("Auth:OAuth:Scopes:Unexpected")]
+	public void unknown_options_detects_invalid_authentication_paths(string key)
+	{
+		var configuration = new ConfigurationBuilder()
+			.AddEventStoreDefaultValues()
+			.AddSection(EventStoreConfigurationKeys.Prefix, builder => builder
+				.AddInMemoryCollection(new Dictionary<string, string?>
+				{
+					["Auth:OAuth:Issuer"] = "https://identity.example.com",
+					[key] = "unexpected"
+				}))
+			.Build();
+
+		var options = ClusterVNodeOptions.FromConfiguration(configuration);
+
+		options.UnknownOptionsDetected.Should().BeTrue();
+		options.Unknown.Options.Select(option => option.Item1).Should().Contain(key);
+	}
+
+	[Fact]
+	public void unknown_options_accepts_current_authentication_shape_and_legacy_provider_setting()
+	{
+		var configuration = new ConfigurationBuilder()
+			.AddEventStoreDefaultValues()
+			.AddSection(EventStoreConfigurationKeys.Prefix, builder => builder
+				.AddInMemoryCollection(new Dictionary<string, string?>
+				{
+					["AuthenticationType"] = "internal",
+					["auth:authenticationtype"] = "internal",
+					["auth:methods:0"] = "password",
+					["auth:oauth:issuer"] = "https://identity.example.com",
+					["auth:oauth:audiences:0"] = "eventstore",
+					["auth:oauth:scopes:0"] = "openid",
+					["auth:oauth:requirehttpsmetadata"] = "true",
+					["auth:oauth:clockskewseconds"] = "30",
+					["Plugins:Custom:Arbitrary"] = "allowed"
+				}))
+			.Build();
+
+		var options = ClusterVNodeOptions.FromConfiguration(configuration);
+
+		options.UnknownOptionsDetected.Should().BeFalse();
+		options.Auth.OAuth.Issuer.Should().Be("https://identity.example.com");
+		options.Auth.Methods.Should().Equal("password");
+	}
+
 	[Fact]
 	public void validation_should_return_error_when_default_password_options_pass_through_command_line()
 	{
diff --git a/src/EventStore.Core/Configuration/ClusterVNodeOptions.cs b/src/EventStore.Core/Configuration/ClusterVNodeOptions.cs
index 28e4595ddd..66047ed258 100644
--- a/src/EventStore.Core/Configuration/ClusterVNodeOptions.cs
+++ b/src/EventStore.Core/Configuration/ClusterVNodeOptions.cs
@@ -721,19 +721,52 @@ public static UnknownOptions FromConfiguration(IConfiguration configuration)
 			static IEnumerable<string> FindUnknownKeys(IConfiguration configuration,
 				IReadOnlySet<string> knownKeys)
 			{
+				var auth = configuration.GetSection(nameof(Auth));
 				var unknownKeys = configuration
 					.AsEnumerable()
 					.Select(kvp => kvp.Key)
+					.Where(key => !key.Equals(auth.Path, StringComparison.OrdinalIgnoreCase)
+						&& !key.StartsWith(auth.Path + ":", StringComparison.OrdinalIgnoreCase))
 					.Where(key => key != EventStoreConfigurationKeys.Prefix
 								  && !knownKeys.Contains(EventStoreConfigurationKeys.Normalize(key)))
 					.ToList();
 
 				var unknownSections = FindUnknownSections(unknownKeys);
 
-				// only report top level unknown keys. plugins, metrics, etc will use nested keys.
-				// in the future we may report unknown keys in nested sections but it is out of scope for now.
+				// Plugins and metrics own their nested configuration, but Auth is a server-owned schema.
 				return unknownKeys
-					.Where(key => !unknownSections.Any(key.StartsWith));
+					.Where(key => !unknownSections.Any(key.StartsWith))
+					.Concat(FindUnknownAuthKeys(auth, typeof(AuthOptions)));
+			}
+
+			static IEnumerable<string> FindUnknownAuthKeys(IConfigurationSection section, Type type)
+			{
+				foreach (var child in section.GetChildren())
+				{
+					Type? childType;
+					if (type.IsArray)
+					{
+						childType = child.Key.All(char.IsAsciiDigit) && int.TryParse(child.Key, out _)
+							? type.GetElementType()
+							: null;
+					}
+					else
+					{
+						childType = type == typeof(string) || type.IsValueType
+							? null
+							: type.GetProperties().FirstOrDefault(property =>
+								property.Name.Equals(child.Key, StringComparison.OrdinalIgnoreCase))?.PropertyType;
+					}
+
+					if (childType is null)
+					{
+						yield return child.Path;
+						continue;
+					}
+
+					foreach (var unknownKey in FindUnknownAuthKeys(child, childType))
+						yield return unknownKey;
+				}
 			}
 
 			static HashSet<string> FindUnknownSections(IEnumerable<string> keys)