diff --git a/README.md b/README.md
index 7e08ac6d..0524b527 100644
--- a/README.md
+++ b/README.md
@@ -81,8 +81,9 @@ The structure of the files are as follows (`XXX` means redacted):
   "JwtSettings": {
     "Issuer": "AnalySim",
     "Secret": "XXX",
-    "ExpireTime": 60,
-    "Audience": "https://www.analysim.tech"
+    "ExpireTime": 10,
+    "Audience": "https://www.analysim.tech",
+    "RefreshTokenExpireDays": 14
   },
   "UserQuota":  100000000,
   "registrationCodes": [ "123" ],
diff --git a/src/Analysim.Core/Entities/RefreshToken.cs b/src/Analysim.Core/Entities/RefreshToken.cs
new file mode 100644
index 00000000..43c334d2
--- /dev/null
+++ b/src/Analysim.Core/Entities/RefreshToken.cs
@@ -0,0 +1,43 @@
+using System;
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+
+namespace Core.Entities
+{
+    public class RefreshToken
+    {
+        public int RefreshTokenID { get; set; }
+
+        public int UserID { get; set; }
+
+        public User User { get; set; }
+
+        [Required]
+        public string TokenHash { get; set; }
+
+        public Guid TokenFamilyID { get; set; }
+
+        public DateTime CreatedAt { get; set; }
+
+        public DateTime ExpiresAt { get; set; }
+
+        public DateTime? RevokedAt { get; set; }
+
+        public string ReplacedByTokenHash { get; set; }
+
+        public string RevokedReason { get; set; }
+
+        public string CreatedByIp { get; set; }
+
+        public string RevokedByIp { get; set; }
+
+        [NotMapped]
+        public bool IsExpired => DateTime.UtcNow >= ExpiresAt;
+
+        [NotMapped]
+        public bool IsRevoked => RevokedAt.HasValue;
+
+        [NotMapped]
+        public bool IsActive => !IsRevoked && !IsExpired;
+    }
+}
diff --git a/src/Analysim.Core/Entities/User.cs b/src/Analysim.Core/Entities/User.cs
index 986fc539..fde6c0f2 100644
--- a/src/Analysim.Core/Entities/User.cs
+++ b/src/Analysim.Core/Entities/User.cs
@@ -30,6 +30,8 @@ public class User : IdentityUser<int>
         // Logs
         public ICollection<ProjectLog> ProjectLogs { get; set; } = new List<ProjectLog>();
 
+        public ICollection<RefreshToken> RefreshTokens { get; set; } = new List<RefreshToken>();
+
         public string RegistrationSurvey {get; set;}
 
     }
diff --git a/src/Analysim.Core/Helper/JwtSettings.cs b/src/Analysim.Core/Helper/JwtSettings.cs
index bd271d8b..f20e2325 100644
--- a/src/Analysim.Core/Helper/JwtSettings.cs
+++ b/src/Analysim.Core/Helper/JwtSettings.cs
@@ -11,5 +11,6 @@ public class JwtSettings
         public string Secret { get; set; }
         public string ExpireTime { get; set; }
         public string Audience { get; set; }
+        public int RefreshTokenExpireDays { get; set; } = 14;
     }
 }
diff --git a/src/Analysim.Infrastructure/Data/ApplicationDbContext.cs b/src/Analysim.Infrastructure/Data/ApplicationDbContext.cs
index 611a7a0f..79751278 100644
--- a/src/Analysim.Infrastructure/Data/ApplicationDbContext.cs
+++ b/src/Analysim.Infrastructure/Data/ApplicationDbContext.cs
@@ -8,6 +8,8 @@ namespace Infrastructure.Data
 {
     public class ApplicationDbContext : IdentityDbContext<User, IdentityRole<int>, int>
     {
+        public DbSet<RefreshToken> RefreshTokens { get; set; }
+
         public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options) : base(options)
         {
 
@@ -24,6 +26,16 @@ protected override void OnModelCreating(ModelBuilder modelBuilder)
             modelBuilder.Entity<UserUser>().HasKey(uu => new { uu.UserID, uu.FollowerID });
             modelBuilder.Entity<NotebookContent>().HasKey(nc => new { nc.NotebookID, nc.Version });
 
+            modelBuilder.Entity<RefreshToken>()
+                        .HasIndex(rt => rt.TokenHash)
+                        .IsUnique();
+
+            modelBuilder.Entity<RefreshToken>()
+                        .HasIndex(rt => rt.UserID);
+
+            modelBuilder.Entity<RefreshToken>()
+                        .HasIndex(rt => rt.TokenFamilyID);
+
             // Many To Many Relationship (ProjectUser -> User)
             modelBuilder.Entity<ProjectUser>()
                         .HasOne<User>(i => i.User)
@@ -66,6 +78,12 @@ protected override void OnModelCreating(ModelBuilder modelBuilder)
                         .WithOne(u => u.User)
                         .HasForeignKey(u => u.UserID);
 
+            modelBuilder.Entity<User>()
+                        .HasMany(u => u.RefreshTokens)
+                        .WithOne(rt => rt.User)
+                        .HasForeignKey(rt => rt.UserID)
+                        .OnDelete(DeleteBehavior.Cascade);
+
             // One To Many Relationship (Project -> Blob)
             modelBuilder.Entity<Project>()
                         .HasMany(p => p.BlobFiles)
diff --git a/src/Analysim.Infrastructure/Infrastructure/Migrations/ApplicationDbContextModelSnapshot.cs b/src/Analysim.Infrastructure/Infrastructure/Migrations/ApplicationDbContextModelSnapshot.cs
index 5036053f..91c60939 100644
--- a/src/Analysim.Infrastructure/Infrastructure/Migrations/ApplicationDbContextModelSnapshot.cs
+++ b/src/Analysim.Infrastructure/Infrastructure/Migrations/ApplicationDbContextModelSnapshot.cs
@@ -491,6 +491,57 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.ToTable("Publications");
                 });
 
+            modelBuilder.Entity("Core.Entities.RefreshToken", b =>
+                {
+                    b.Property<int>("RefreshTokenID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("RefreshTokenID"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("CreatedByIp")
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ReplacedByTokenHash")
+                        .HasColumnType("text");
+
+                    b.Property<DateTime?>("RevokedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("RevokedByIp")
+                        .HasColumnType("text");
+
+                    b.Property<string>("RevokedReason")
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("TokenFamilyID")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer");
+
+                    b.HasKey("RefreshTokenID");
+
+                    b.HasIndex("TokenFamilyID");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.HasIndex("UserID");
+
+                    b.ToTable("RefreshTokens");
+                });
+
             modelBuilder.Entity("Core.Entities.Tag", b =>
                 {
                     b.Property<int>("TagID")
@@ -979,6 +1030,17 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.Navigation("Project");
                 });
 
+            modelBuilder.Entity("Core.Entities.RefreshToken", b =>
+                {
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
             modelBuilder.Entity("Core.Entities.UserUser", b =>
                 {
                     b.HasOne("Core.Entities.User", "Follower")
@@ -1114,6 +1176,8 @@ protected override void BuildModel(ModelBuilder modelBuilder)
                     b.Navigation("ProjectLogs");
 
                     b.Navigation("ProjectUsers");
+
+                    b.Navigation("RefreshTokens");
                 });
 #pragma warning restore 612, 618
         }
diff --git a/src/Analysim.Infrastructure/Migrations/20260717132040_AddRefreshTokens.Designer.cs b/src/Analysim.Infrastructure/Migrations/20260717132040_AddRefreshTokens.Designer.cs
new file mode 100644
index 00000000..9de0a676
--- /dev/null
+++ b/src/Analysim.Infrastructure/Migrations/20260717132040_AddRefreshTokens.Designer.cs
@@ -0,0 +1,1182 @@
+// <auto-generated />
+using System;
+using Infrastructure.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace Infrastructure.Migrations
+{
+    [DbContext(typeof(ApplicationDbContext))]
+    [Migration("20260717132040_AddRefreshTokens")]
+    partial class AddRefreshTokens
+    {
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder
+                .HasAnnotation("ProductVersion", "6.0.6")
+                .HasAnnotation("Relational:MaxIdentifierLength", 63);
+
+            NpgsqlModelBuilderExtensions.UseIdentityByDefaultColumns(modelBuilder);
+
+            modelBuilder.Entity("Analysim.Core.Entities.BlobFileContent", b =>
+                {
+                    b.Property<int>("BlobFileID")
+                        .HasColumnType("integer");
+
+                    b.Property<byte[]>("Content")
+                        .IsRequired()
+                        .HasColumnType("bytea");
+
+                    b.Property<DateTimeOffset>("DateCreated")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("BlobFileID");
+
+                    b.ToTable("BlobFileContent");
+                });
+
+            modelBuilder.Entity("Analysim.Core.Entities.NotebookContent", b =>
+                {
+                    b.Property<int>("NotebookID")
+                        .HasColumnType("integer")
+                        .HasColumnOrder(1);
+
+                    b.Property<int>("Version")
+                        .HasColumnType("integer")
+                        .HasColumnOrder(2);
+
+                    b.Property<string>("Author")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<byte[]>("Content")
+                        .IsRequired()
+                        .HasColumnType("bytea");
+
+                    b.Property<DateTimeOffset>("DateCreated")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("Size")
+                        .HasColumnType("integer");
+
+                    b.HasKey("NotebookID", "Version");
+
+                    b.ToTable("NotebookContent");
+                });
+
+            modelBuilder.Entity("Core.Entities.BlobFile", b =>
+                {
+                    b.Property<int>("BlobFileID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("BlobFileID"));
+
+                    b.Property<string>("Container")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("DateCreated")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Directory")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Extension")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("LastModified")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int?>("ProjectID")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("Size")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Uri")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer");
+
+                    b.HasKey("BlobFileID");
+
+                    b.HasIndex("ProjectID");
+
+                    b.HasIndex("UserID");
+
+                    b.ToTable("BlobFiles");
+                });
+
+            modelBuilder.Entity("Core.Entities.Notebook", b =>
+                {
+                    b.Property<int>("NotebookID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("NotebookID"));
+
+                    b.Property<string>("Container")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("DateCreated")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Directory")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Extension")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("LastModified")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int?>("ProjectID")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Route")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("Size")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Uri")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("type")
+                        .HasColumnType("text");
+
+                    b.HasKey("NotebookID");
+
+                    b.HasIndex("Directory");
+
+                    b.HasIndex("ProjectID");
+
+                    b.ToTable("Notebook");
+                });
+
+            modelBuilder.Entity("Core.Entities.ObservableNotebookDataset", b =>
+                {
+                    b.Property<int>("ID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("ID"));
+
+                    b.Property<int>("BlobFileID")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("NotebookID")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("datasetName")
+                        .HasColumnType("text");
+
+                    b.Property<string>("datasetURL")
+                        .HasColumnType("text");
+
+                    b.HasKey("ID");
+
+                    b.HasIndex("NotebookID");
+
+                    b.ToTable("ObservableNotebookDataset");
+                });
+
+            modelBuilder.Entity("Core.Entities.Project", b =>
+                {
+                    b.Property<int>("ProjectID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("ProjectID"));
+
+                    b.Property<DateTimeOffset>("DateCreated")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Description")
+                        .HasMaxLength(500)
+                        .HasColumnType("character varying(500)");
+
+                    b.Property<int>("ForkedFromProjectID")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTimeOffset>("LastUpdated")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(20)
+                        .HasColumnType("character varying(20)");
+
+                    b.Property<string>("Route")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Visibility")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("ProjectID");
+
+                    b.ToTable("Projects");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectComment", b =>
+                {
+                    b.Property<int>("CommentID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("CommentID"));
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsDeleted")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("IsPendingReview")
+                        .HasColumnType("boolean");
+
+                    b.Property<int?>("ParentCommentID")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("ProjectID")
+                        .HasColumnType("integer");
+
+                    b.Property<int?>("ProjectLogID")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer");
+
+                    b.HasKey("CommentID");
+
+                    b.HasIndex("ParentCommentID");
+
+                    b.HasIndex("ProjectID");
+
+                    b.HasIndex("ProjectLogID");
+
+                    b.HasIndex("UserID");
+
+                    b.ToTable("ProjectComments");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectCommentFlag", b =>
+                {
+                    b.Property<int>("FlagID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("FlagID"));
+
+                    b.Property<string>("CommentContentSnapshot")
+                        .HasColumnType("text");
+
+                    b.Property<int>("CommentID")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer");
+
+                    b.HasKey("FlagID");
+
+                    b.HasIndex("UserID");
+
+                    b.HasIndex("CommentID", "UserID")
+                        .IsUnique();
+
+                    b.ToTable("ProjectCommentFlags");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectCommentLike", b =>
+                {
+                    b.Property<int>("CommentID")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.HasKey("CommentID", "UserID");
+
+                    b.HasIndex("UserID");
+
+                    b.ToTable("ProjectCommentLikes");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectLog", b =>
+                {
+                    b.Property<int>("LogID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("LogID"));
+
+                    b.Property<int?>("BlobFileID")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<DateTime?>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("IsDeleted")
+                        .HasColumnType("boolean");
+
+                    b.Property<int>("ProjectID")
+                        .HasColumnType("integer");
+
+                    b.Property<int?>("ReferencedNotebookID")
+                        .HasColumnType("integer");
+
+                    b.Property<int?>("ReferencedNotebookVersion")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Title")
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("UpdatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer");
+
+                    b.HasKey("LogID");
+
+                    b.HasIndex("BlobFileID");
+
+                    b.HasIndex("ProjectID");
+
+                    b.HasIndex("ReferencedNotebookID");
+
+                    b.HasIndex("UserID");
+
+                    b.ToTable("ProjectLogs");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectTag", b =>
+                {
+                    b.Property<int>("ProjectID")
+                        .HasColumnType("integer")
+                        .HasColumnOrder(2);
+
+                    b.Property<int>("TagID")
+                        .HasColumnType("integer")
+                        .HasColumnOrder(1);
+
+                    b.HasKey("ProjectID", "TagID");
+
+                    b.HasIndex("TagID");
+
+                    b.ToTable("ProjectTags");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectUser", b =>
+                {
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer")
+                        .HasColumnOrder(1);
+
+                    b.Property<int>("ProjectID")
+                        .HasColumnType("integer")
+                        .HasColumnOrder(2);
+
+                    b.Property<bool>("IsFollowing")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("UserRole")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("UserID", "ProjectID");
+
+                    b.HasIndex("ProjectID");
+
+                    b.ToTable("ProjectUsers");
+                });
+
+            modelBuilder.Entity("Core.Entities.Publication", b =>
+                {
+                    b.Property<int>("PublicationID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("PublicationID"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Doi")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Issue")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Journal")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Notes")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Pages")
+                        .HasColumnType("text");
+
+                    b.Property<int>("ProjectID")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("SourceAuthor")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Title")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Url")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Volume")
+                        .HasColumnType("text");
+
+                    b.Property<int?>("Year")
+                        .IsRequired()
+                        .HasColumnType("integer");
+
+                    b.HasKey("PublicationID");
+
+                    b.HasIndex("ProjectID");
+
+                    b.ToTable("Publications");
+                });
+
+            modelBuilder.Entity("Core.Entities.RefreshToken", b =>
+                {
+                    b.Property<int>("RefreshTokenID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("RefreshTokenID"));
+
+                    b.Property<DateTime>("CreatedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("CreatedByIp")
+                        .HasColumnType("text");
+
+                    b.Property<DateTime>("ExpiresAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("ReplacedByTokenHash")
+                        .HasColumnType("text");
+
+                    b.Property<DateTime?>("RevokedAt")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("RevokedByIp")
+                        .HasColumnType("text");
+
+                    b.Property<string>("RevokedReason")
+                        .HasColumnType("text");
+
+                    b.Property<Guid>("TokenFamilyID")
+                        .HasColumnType("uuid");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer");
+
+                    b.HasKey("RefreshTokenID");
+
+                    b.HasIndex("TokenFamilyID");
+
+                    b.HasIndex("TokenHash")
+                        .IsUnique();
+
+                    b.HasIndex("UserID");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("Core.Entities.Tag", b =>
+                {
+                    b.Property<int>("TagID")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("TagID"));
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("text");
+
+                    b.HasKey("TagID");
+
+                    b.ToTable("Tag");
+                });
+
+            modelBuilder.Entity("Core.Entities.User", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<int>("AccessFailedCount")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("Bio")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken()
+                        .HasColumnType("text");
+
+                    b.Property<DateTimeOffset>("DateCreated")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("Email")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<bool>("EmailConfirmed")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset>("LastOnline")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<bool>("LockoutEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<DateTimeOffset?>("LockoutEnd")
+                        .HasColumnType("timestamp with time zone");
+
+                    b.Property<string>("NormalizedEmail")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("NormalizedUserName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("PasswordHash")
+                        .HasColumnType("text");
+
+                    b.Property<string>("PhoneNumber")
+                        .HasColumnType("text");
+
+                    b.Property<bool>("PhoneNumberConfirmed")
+                        .HasColumnType("boolean");
+
+                    b.Property<bool>("ReceiveCommentReplyEmails")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("RegistrationSurvey")
+                        .HasColumnType("text");
+
+                    b.Property<string>("SecurityStamp")
+                        .HasColumnType("text");
+
+                    b.Property<bool>("TwoFactorEnabled")
+                        .HasColumnType("boolean");
+
+                    b.Property<string>("UserName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedEmail")
+                        .HasDatabaseName("EmailIndex");
+
+                    b.HasIndex("NormalizedUserName")
+                        .IsUnique()
+                        .HasDatabaseName("UserNameIndex");
+
+                    b.ToTable("AspNetUsers", (string)null);
+                });
+
+            modelBuilder.Entity("Core.Entities.UserUser", b =>
+                {
+                    b.Property<int>("UserID")
+                        .HasColumnType("integer")
+                        .HasColumnOrder(1);
+
+                    b.Property<int>("FollowerID")
+                        .HasColumnType("integer")
+                        .HasColumnOrder(2);
+
+                    b.HasKey("UserID", "FollowerID");
+
+                    b.HasIndex("FollowerID");
+
+                    b.ToTable("UserUsers");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRole<int>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ConcurrencyStamp")
+                        .IsConcurrencyToken()
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.Property<string>("NormalizedName")
+                        .HasMaxLength(256)
+                        .HasColumnType("character varying(256)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("NormalizedName")
+                        .IsUnique()
+                        .HasDatabaseName("RoleNameIndex");
+
+                    b.ToTable("AspNetRoles", (string)null);
+
+                    b.HasData(
+                        new
+                        {
+                            Id = 1,
+                            ConcurrencyStamp = "d7c6278e-3f78-4db6-8832-aa41ea9fd62c",
+                            Name = "Admin",
+                            NormalizedName = "ADMIN"
+                        },
+                        new
+                        {
+                            Id = 2,
+                            ConcurrencyStamp = "7383e31e-a884-4cd6-82f7-a6287b4e30a5",
+                            Name = "Customer",
+                            NormalizedName = "CUSTOMER"
+                        },
+                        new
+                        {
+                            Id = 3,
+                            ConcurrencyStamp = "398ef1f2-6b82-45f2-9601-ed2129f197e9",
+                            Name = "Moderator",
+                            NormalizedName = "MODERATOR"
+                        });
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<int>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ClaimType")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ClaimValue")
+                        .HasColumnType("text");
+
+                    b.Property<int>("RoleId")
+                        .HasColumnType("integer");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetRoleClaims", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<int>", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("integer");
+
+                    NpgsqlPropertyBuilderExtensions.UseIdentityByDefaultColumn(b.Property<int>("Id"));
+
+                    b.Property<string>("ClaimType")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ClaimValue")
+                        .HasColumnType("text");
+
+                    b.Property<int>("UserId")
+                        .HasColumnType("integer");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserClaims", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<int>", b =>
+                {
+                    b.Property<string>("LoginProvider")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ProviderKey")
+                        .HasColumnType("text");
+
+                    b.Property<string>("ProviderDisplayName")
+                        .HasColumnType("text");
+
+                    b.Property<int>("UserId")
+                        .HasColumnType("integer");
+
+                    b.HasKey("LoginProvider", "ProviderKey");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("AspNetUserLogins", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<int>", b =>
+                {
+                    b.Property<int>("UserId")
+                        .HasColumnType("integer");
+
+                    b.Property<int>("RoleId")
+                        .HasColumnType("integer");
+
+                    b.HasKey("UserId", "RoleId");
+
+                    b.HasIndex("RoleId");
+
+                    b.ToTable("AspNetUserRoles", (string)null);
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<int>", b =>
+                {
+                    b.Property<int>("UserId")
+                        .HasColumnType("integer");
+
+                    b.Property<string>("LoginProvider")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Name")
+                        .HasColumnType("text");
+
+                    b.Property<string>("Value")
+                        .HasColumnType("text");
+
+                    b.HasKey("UserId", "LoginProvider", "Name");
+
+                    b.ToTable("AspNetUserTokens", (string)null);
+                });
+
+            modelBuilder.Entity("Analysim.Core.Entities.BlobFileContent", b =>
+                {
+                    b.HasOne("Core.Entities.BlobFile", "BlobFile")
+                        .WithMany("BlobFileContents")
+                        .HasForeignKey("BlobFileID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("BlobFile");
+                });
+
+            modelBuilder.Entity("Analysim.Core.Entities.NotebookContent", b =>
+                {
+                    b.HasOne("Core.Entities.Notebook", "Notebook")
+                        .WithMany("NotebookContents")
+                        .HasForeignKey("NotebookID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Notebook");
+                });
+
+            modelBuilder.Entity("Core.Entities.BlobFile", b =>
+                {
+                    b.HasOne("Core.Entities.Project", "Project")
+                        .WithMany("BlobFiles")
+                        .HasForeignKey("ProjectID")
+                        .OnDelete(DeleteBehavior.Cascade);
+
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("BlobFiles")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Project");
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Core.Entities.Notebook", b =>
+                {
+                    b.HasOne("Core.Entities.Project", "Project")
+                        .WithMany("Notebooks")
+                        .HasForeignKey("ProjectID")
+                        .OnDelete(DeleteBehavior.Cascade);
+
+                    b.Navigation("Project");
+                });
+
+            modelBuilder.Entity("Core.Entities.ObservableNotebookDataset", b =>
+                {
+                    b.HasOne("Core.Entities.Notebook", "notebook")
+                        .WithMany("observableNotebookDatasets")
+                        .HasForeignKey("NotebookID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("notebook");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectComment", b =>
+                {
+                    b.HasOne("Core.Entities.ProjectComment", "ParentComment")
+                        .WithMany("Replies")
+                        .HasForeignKey("ParentCommentID")
+                        .OnDelete(DeleteBehavior.Restrict);
+
+                    b.HasOne("Core.Entities.Project", "Project")
+                        .WithMany("ProjectComments")
+                        .HasForeignKey("ProjectID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Core.Entities.ProjectLog", "ProjectLog")
+                        .WithMany("Comments")
+                        .HasForeignKey("ProjectLogID")
+                        .OnDelete(DeleteBehavior.Restrict);
+
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("ProjectComments")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.Navigation("ParentComment");
+
+                    b.Navigation("Project");
+
+                    b.Navigation("ProjectLog");
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectCommentFlag", b =>
+                {
+                    b.HasOne("Core.Entities.ProjectComment", "ProjectComment")
+                        .WithMany("CommentFlags")
+                        .HasForeignKey("CommentID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("CommentFlags")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("ProjectComment");
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectCommentLike", b =>
+                {
+                    b.HasOne("Core.Entities.ProjectComment", "ProjectComment")
+                        .WithMany("CommentLikes")
+                        .HasForeignKey("CommentID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("CommentLikes")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("ProjectComment");
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectLog", b =>
+                {
+                    b.HasOne("Core.Entities.BlobFile", "BlobFile")
+                        .WithMany()
+                        .HasForeignKey("BlobFileID")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Core.Entities.Project", "Project")
+                        .WithMany("ProjectLogs")
+                        .HasForeignKey("ProjectID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Core.Entities.Notebook", "ReferencedNotebook")
+                        .WithMany()
+                        .HasForeignKey("ReferencedNotebookID")
+                        .OnDelete(DeleteBehavior.SetNull);
+
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("ProjectLogs")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Restrict)
+                        .IsRequired();
+
+                    b.Navigation("BlobFile");
+
+                    b.Navigation("Project");
+
+                    b.Navigation("ReferencedNotebook");
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectTag", b =>
+                {
+                    b.HasOne("Core.Entities.Project", "Project")
+                        .WithMany("ProjectTags")
+                        .HasForeignKey("ProjectID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Core.Entities.Tag", "Tag")
+                        .WithMany("ProjectTags")
+                        .HasForeignKey("TagID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Project");
+
+                    b.Navigation("Tag");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectUser", b =>
+                {
+                    b.HasOne("Core.Entities.Project", "Project")
+                        .WithMany("ProjectUsers")
+                        .HasForeignKey("ProjectID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("ProjectUsers")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Project");
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Core.Entities.Publication", b =>
+                {
+                    b.HasOne("Core.Entities.Project", "Project")
+                        .WithMany("Publications")
+                        .HasForeignKey("ProjectID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Project");
+                });
+
+            modelBuilder.Entity("Core.Entities.RefreshToken", b =>
+                {
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Core.Entities.UserUser", b =>
+                {
+                    b.HasOne("Core.Entities.User", "Follower")
+                        .WithMany("Following")
+                        .HasForeignKey("FollowerID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Core.Entities.User", "User")
+                        .WithMany("Followers")
+                        .HasForeignKey("UserID")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Follower");
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityRoleClaim<int>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole<int>", null)
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserClaim<int>", b =>
+                {
+                    b.HasOne("Core.Entities.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserLogin<int>", b =>
+                {
+                    b.HasOne("Core.Entities.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserRole<int>", b =>
+                {
+                    b.HasOne("Microsoft.AspNetCore.Identity.IdentityRole<int>", null)
+                        .WithMany()
+                        .HasForeignKey("RoleId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("Core.Entities.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Microsoft.AspNetCore.Identity.IdentityUserToken<int>", b =>
+                {
+                    b.HasOne("Core.Entities.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("Core.Entities.BlobFile", b =>
+                {
+                    b.Navigation("BlobFileContents");
+                });
+
+            modelBuilder.Entity("Core.Entities.Notebook", b =>
+                {
+                    b.Navigation("NotebookContents");
+
+                    b.Navigation("observableNotebookDatasets");
+                });
+
+            modelBuilder.Entity("Core.Entities.Project", b =>
+                {
+                    b.Navigation("BlobFiles");
+
+                    b.Navigation("Notebooks");
+
+                    b.Navigation("ProjectComments");
+
+                    b.Navigation("ProjectLogs");
+
+                    b.Navigation("ProjectTags");
+
+                    b.Navigation("ProjectUsers");
+
+                    b.Navigation("Publications");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectComment", b =>
+                {
+                    b.Navigation("CommentFlags");
+
+                    b.Navigation("CommentLikes");
+
+                    b.Navigation("Replies");
+                });
+
+            modelBuilder.Entity("Core.Entities.ProjectLog", b =>
+                {
+                    b.Navigation("Comments");
+                });
+
+            modelBuilder.Entity("Core.Entities.Tag", b =>
+                {
+                    b.Navigation("ProjectTags");
+                });
+
+            modelBuilder.Entity("Core.Entities.User", b =>
+                {
+                    b.Navigation("BlobFiles");
+
+                    b.Navigation("CommentFlags");
+
+                    b.Navigation("CommentLikes");
+
+                    b.Navigation("Followers");
+
+                    b.Navigation("Following");
+
+                    b.Navigation("ProjectComments");
+
+                    b.Navigation("ProjectLogs");
+
+                    b.Navigation("ProjectUsers");
+
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/src/Analysim.Infrastructure/Migrations/20260717132040_AddRefreshTokens.cs b/src/Analysim.Infrastructure/Migrations/20260717132040_AddRefreshTokens.cs
new file mode 100644
index 00000000..d1251a26
--- /dev/null
+++ b/src/Analysim.Infrastructure/Migrations/20260717132040_AddRefreshTokens.cs
@@ -0,0 +1,64 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Npgsql.EntityFrameworkCore.PostgreSQL.Metadata;
+
+#nullable disable
+
+namespace Infrastructure.Migrations
+{
+    public partial class AddRefreshTokens : Migration
+    {
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "RefreshTokens",
+                columns: table => new
+                {
+                    RefreshTokenID = table.Column<int>(type: "integer", nullable: false)
+                        .Annotation("Npgsql:ValueGenerationStrategy", NpgsqlValueGenerationStrategy.IdentityByDefaultColumn),
+                    UserID = table.Column<int>(type: "integer", nullable: false),
+                    TokenHash = table.Column<string>(type: "text", nullable: false),
+                    TokenFamilyID = table.Column<Guid>(type: "uuid", nullable: false),
+                    CreatedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    ExpiresAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: false),
+                    RevokedAt = table.Column<DateTime>(type: "timestamp with time zone", nullable: true),
+                    ReplacedByTokenHash = table.Column<string>(type: "text", nullable: true),
+                    RevokedReason = table.Column<string>(type: "text", nullable: true),
+                    CreatedByIp = table.Column<string>(type: "text", nullable: true),
+                    RevokedByIp = table.Column<string>(type: "text", nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_RefreshTokens", x => x.RefreshTokenID);
+                    table.ForeignKey(
+                        name: "FK_RefreshTokens_AspNetUsers_UserID",
+                        column: x => x.UserID,
+                        principalTable: "AspNetUsers",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_RefreshTokens_TokenFamilyID",
+                table: "RefreshTokens",
+                column: "TokenFamilyID");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_RefreshTokens_TokenHash",
+                table: "RefreshTokens",
+                column: "TokenHash",
+                unique: true);
+
+            migrationBuilder.CreateIndex(
+                name: "IX_RefreshTokens_UserID",
+                table: "RefreshTokens",
+                column: "UserID");
+        }
+
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "RefreshTokens");
+        }
+    }
+}
diff --git a/src/Analysim.Web/ClientApp/src/app/admin/components/users/user-display/user-display.component.html b/src/Analysim.Web/ClientApp/src/app/admin/components/users/user-display/user-display.component.html
index d8bc70ff..fa74b810 100644
--- a/src/Analysim.Web/ClientApp/src/app/admin/components/users/user-display/user-display.component.html
+++ b/src/Analysim.Web/ClientApp/src/app/admin/components/users/user-display/user-display.component.html
@@ -1,7 +1,17 @@
 <td>
   <button
     type="button"
-    class="btn btn-secondary"
+    class="btn btn-sm mr-2"
+    [ngClass]="isDisabled() ? 'btn-success' : 'btn-warning'"
+    [disabled]="statusLoading"
+    (click)="setDisabled(!isDisabled())"
+  >
+    <i class="fa mr-1" [ngClass]="isDisabled() ? 'fa-check' : 'fa-ban'"></i>
+    {{ isDisabled() ? "Enable" : "Disable" }}
+  </button>
+  <button
+    type="button"
+    class="btn btn-sm btn-secondary"
     data-toggle="modal"
     [attr.data-target]="'#deleteModal' + user.id"
   >
diff --git a/src/Analysim.Web/ClientApp/src/app/admin/components/users/user-display/user-display.component.ts b/src/Analysim.Web/ClientApp/src/app/admin/components/users/user-display/user-display.component.ts
index 3608d852..9ad154b4 100644
--- a/src/Analysim.Web/ClientApp/src/app/admin/components/users/user-display/user-display.component.ts
+++ b/src/Analysim.Web/ClientApp/src/app/admin/components/users/user-display/user-display.component.ts
@@ -11,6 +11,9 @@ export class UserDisplayComponent implements OnInit {
 
   @Input() user: User;
   @Output() userDeleted : EventEmitter<any> = new EventEmitter<any>();
+  @Output() userUpdated : EventEmitter<User> = new EventEmitter<User>();
+  statusLoading = false;
+
   constructor(private accountService: AccountService) { }
 
   ngOnInit(): void {
@@ -22,4 +25,21 @@ export class UserDisplayComponent implements OnInit {
       })
   }
 
+  isDisabled(): boolean {
+    return !!this.user.lockoutEnd && new Date(this.user.lockoutEnd).valueOf() > new Date().valueOf();
+  }
+
+  setDisabled(disabled: boolean) {
+    this.statusLoading = true;
+    this.accountService.setAccountStatus(this.user.id, disabled).subscribe({
+      next: (updatedUser) => {
+        this.user = updatedUser;
+        this.statusLoading = false;
+        this.userUpdated.emit(updatedUser);
+      },
+      error: () => {
+        this.statusLoading = false;
+      }
+    });
+  }
 }
diff --git a/src/Analysim.Web/ClientApp/src/app/admin/components/users/users.component.html b/src/Analysim.Web/ClientApp/src/app/admin/components/users/users.component.html
index da2bb69c..01c3c439 100644
--- a/src/Analysim.Web/ClientApp/src/app/admin/components/users/users.component.html
+++ b/src/Analysim.Web/ClientApp/src/app/admin/components/users/users.component.html
@@ -9,6 +9,7 @@ <h5>All Users</h5>
           <th>Username</th>
           <th>Email</th>
           <th>Date Created</th>
+          <th>Status</th>
           <th>Actions</th>
         </tr>
       </thead>
@@ -19,7 +20,16 @@ <h5>All Users</h5>
           </td>
           <td>{{ u.email }}</td>
           <td>{{ u.dateCreated | date : "short" }}</td>
-        <app-user-display [user]="u" (userDeleted)="loadUsers()"></app-user-display>
+          <td>
+            <span class="badge" [ngClass]="isUserDisabled(u) ? 'badge-warning' : 'badge-success'">
+              {{ isUserDisabled(u) ? "Disabled" : "Enabled" }}
+            </span>
+          </td>
+          <app-user-display
+            [user]="u"
+            (userDeleted)="loadUsers()"
+            (userUpdated)="loadUsers()"
+          ></app-user-display>
         </tr>
       </tbody>
     </table>
@@ -29,4 +39,4 @@ <h5>All Users</h5>
     </div>
     <div class="p-3 text-danger" *ngIf="error">{{ error }}</div>
   </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/src/Analysim.Web/ClientApp/src/app/admin/components/users/users.component.ts b/src/Analysim.Web/ClientApp/src/app/admin/components/users/users.component.ts
index ec7924f0..9820cf42 100644
--- a/src/Analysim.Web/ClientApp/src/app/admin/components/users/users.component.ts
+++ b/src/Analysim.Web/ClientApp/src/app/admin/components/users/users.component.ts
@@ -32,4 +32,8 @@ export class UsersComponent implements OnInit {
       },
     });
   }
+
+  isUserDisabled(user: User): boolean {
+    return !!user.lockoutEnd && new Date(user.lockoutEnd).valueOf() > new Date().valueOf();
+  }
 }
diff --git a/src/Analysim.Web/ClientApp/src/app/app.module.ts b/src/Analysim.Web/ClientApp/src/app/app.module.ts
index 9d006cc0..97abc6c6 100644
--- a/src/Analysim.Web/ClientApp/src/app/app.module.ts
+++ b/src/Analysim.Web/ClientApp/src/app/app.module.ts
@@ -1,6 +1,6 @@
 import { BrowserModule } from '@angular/platform-browser';
 import { NgModule } from '@angular/core';
-import { HttpClientModule } from '@angular/common/http';
+import { HTTP_INTERCEPTORS, HttpClientModule, HttpClientXsrfModule } from '@angular/common/http';
 import { AppRoutingModule } from './app-routing.module';
 import { FormsModule, ReactiveFormsModule } from '@angular/forms';
 import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
@@ -32,6 +32,7 @@ import { EmailConfirmationComponent } from './email-confirmation/email-confirmat
 import { EmailForgotPassComponent } from './email-confirmation/email-forgot-pass/email-forgot-pass.component';
 import { ResetPasswordComponent } from './email-confirmation/reset-password/reset-password.component';
 import { EmailResendVerificationComponent } from './email-confirmation/email-resend-verification/email-resend-verification.component';
+import { AuthInterceptor } from './interceptors/auth.interceptor';
 
 @NgModule({
   declarations: [
@@ -63,6 +64,10 @@ import { EmailResendVerificationComponent } from './email-confirmation/email-res
     BrowserModule,
     AppRoutingModule,
     HttpClientModule,
+    HttpClientXsrfModule.withOptions({
+      cookieName: 'XSRF-TOKEN',
+      headerName: 'X-XSRF-TOKEN',
+    }),
     FormsModule,
     ReactiveFormsModule,
     BrowserAnimationsModule,
@@ -71,6 +76,7 @@ import { EmailResendVerificationComponent } from './email-confirmation/email-res
     ModalModule.forRoot(),
   ],
   providers: [
+    { provide: HTTP_INTERCEPTORS, useClass: AuthInterceptor, multi: true },
   ],
   bootstrap: [AppComponent]
 })
diff --git a/src/Analysim.Web/ClientApp/src/app/guards/admin.guard.ts b/src/Analysim.Web/ClientApp/src/app/guards/admin.guard.ts
index b0ee1d9f..3739065b 100644
--- a/src/Analysim.Web/ClientApp/src/app/guards/admin.guard.ts
+++ b/src/Analysim.Web/ClientApp/src/app/guards/admin.guard.ts
@@ -16,9 +16,7 @@ export class AdminGuard implements CanActivate {
   ) {}
 
   public async canActivate(): Promise<boolean> {
-    const isLoggedIn = await firstValueFrom(
-      this.account.isLoggedIn.pipe(take(1))
-    );
+    const isLoggedIn = await firstValueFrom(this.account.ensureAuthenticated());
     if (!isLoggedIn) {
       this.router.navigate(['/login']);
       return false;
diff --git a/src/Analysim.Web/ClientApp/src/app/guards/auth-guard.service.ts b/src/Analysim.Web/ClientApp/src/app/guards/auth-guard.service.ts
index 0569a09d..b0f3cb63 100644
--- a/src/Analysim.Web/ClientApp/src/app/guards/auth-guard.service.ts
+++ b/src/Analysim.Web/ClientApp/src/app/guards/auth-guard.service.ts
@@ -1,7 +1,7 @@
 import { Injectable } from '@angular/core';
 import { CanActivate, RouterStateSnapshot, Router, ActivatedRouteSnapshot } from '@angular/router';
 import { AccountService } from '../services/account.service';
-import { take, map } from 'rxjs/operators';
+import { map } from 'rxjs/operators';
 import { Observable } from 'rxjs';
 
 @Injectable({
@@ -12,7 +12,7 @@ export class AuthGuardService implements CanActivate {
   constructor(private acct : AccountService, private router: Router) { }
 
   canActivate(route : ActivatedRouteSnapshot, state : RouterStateSnapshot) : Observable<boolean> {
-    return this.acct.isLoggedIn.pipe(take(1), map((loginStatus : boolean) =>
+    return this.acct.ensureAuthenticated().pipe(map((loginStatus : boolean) =>
     {
       const destination : string = state.url
 
diff --git a/src/Analysim.Web/ClientApp/src/app/interceptors/auth.interceptor.spec.ts b/src/Analysim.Web/ClientApp/src/app/interceptors/auth.interceptor.spec.ts
new file mode 100644
index 00000000..c3b9cbc1
--- /dev/null
+++ b/src/Analysim.Web/ClientApp/src/app/interceptors/auth.interceptor.spec.ts
@@ -0,0 +1,60 @@
+import { HTTP_INTERCEPTORS, HttpClient, HttpHeaders } from '@angular/common/http';
+import { HttpClientTestingModule, HttpTestingController } from '@angular/common/http/testing';
+import { TestBed } from '@angular/core/testing';
+import { of } from 'rxjs';
+import { AuthInterceptor } from './auth.interceptor';
+import { AccountService } from '../services/account.service';
+
+describe('AuthInterceptor', () => {
+  let http: HttpClient;
+  let httpMock: HttpTestingController;
+  let accountService: jasmine.SpyObj<AccountService>;
+
+  beforeEach(() => {
+    accountService = jasmine.createSpyObj<AccountService>(
+      'AccountService',
+      ['refreshSession', 'clearAuthenticationState']
+    );
+    accountService.refreshSession.and.returnValue(of({ result: { id: 1 } }));
+
+    TestBed.configureTestingModule({
+      imports: [HttpClientTestingModule],
+      providers: [
+        { provide: AccountService, useValue: accountService },
+        { provide: HTTP_INTERCEPTORS, useClass: AuthInterceptor, multi: true },
+      ],
+    });
+
+    http = TestBed.inject(HttpClient);
+    httpMock = TestBed.inject(HttpTestingController);
+  });
+
+  afterEach(() => {
+    httpMock.verify();
+  });
+
+  it('sends credentials and strips stale bearer headers', () => {
+    http.get('/api/projects', {
+      headers: new HttpHeaders({ Authorization: 'Bearer stale-token' }),
+    }).subscribe();
+
+    const request = httpMock.expectOne('/api/projects');
+    expect(request.request.withCredentials).toBeTrue();
+    expect(request.request.headers.has('Authorization')).toBeFalse();
+
+    request.flush({});
+  });
+
+  it('refreshes once on 401 and retries the original request', () => {
+    http.get('/api/projects').subscribe();
+
+    const firstRequest = httpMock.expectOne('/api/projects');
+    firstRequest.flush({}, { status: 401, statusText: 'Unauthorized' });
+
+    expect(accountService.refreshSession).toHaveBeenCalledTimes(1);
+
+    const retryRequest = httpMock.expectOne('/api/projects');
+    expect(retryRequest.request.headers.get('X-Auth-Retry')).toBe('1');
+    retryRequest.flush({ result: [] });
+  });
+});
diff --git a/src/Analysim.Web/ClientApp/src/app/interceptors/auth.interceptor.ts b/src/Analysim.Web/ClientApp/src/app/interceptors/auth.interceptor.ts
new file mode 100644
index 00000000..7fbff7d3
--- /dev/null
+++ b/src/Analysim.Web/ClientApp/src/app/interceptors/auth.interceptor.ts
@@ -0,0 +1,101 @@
+import { Injectable, Injector } from '@angular/core';
+import {
+  HttpErrorResponse,
+  HttpEvent,
+  HttpHandler,
+  HttpInterceptor,
+  HttpRequest,
+} from '@angular/common/http';
+import { BehaviorSubject, Observable, throwError } from 'rxjs';
+import { catchError, filter, switchMap, take } from 'rxjs/operators';
+import { AccountService } from '../services/account.service';
+
+@Injectable()
+export class AuthInterceptor implements HttpInterceptor {
+  private isRefreshing = false;
+  private refreshResult = new BehaviorSubject<boolean | null>(null);
+
+  constructor(private injector: Injector) {}
+
+  intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
+    const authRequest = this.prepareRequest(request);
+
+    return next.handle(authRequest).pipe(
+      catchError((error: HttpErrorResponse) => {
+        if (!this.shouldRefresh(authRequest, error)) {
+          return throwError(error);
+        }
+
+        return this.refreshAndRetry(authRequest, next);
+      })
+    );
+  }
+
+  private prepareRequest(request: HttpRequest<any>): HttpRequest<any> {
+    let headers = request.headers;
+    const authorization = headers.get('Authorization');
+
+    if (authorization && authorization.toLowerCase().startsWith('bearer ')) {
+      headers = headers.delete('Authorization');
+    }
+
+    return request.clone({
+      headers,
+      withCredentials: true,
+    });
+  }
+
+  private shouldRefresh(request: HttpRequest<any>, error: HttpErrorResponse): boolean {
+    if (error.status !== 401 || request.headers.has('X-Auth-Retry')) {
+      return false;
+    }
+
+    const url = request.url.toLowerCase();
+    return !url.includes('/api/account/login')
+      && !url.includes('/api/account/refresh')
+      && !url.includes('/api/account/logout');
+  }
+
+  private refreshAndRetry(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
+    const accountService = this.injector.get(AccountService);
+
+    if (this.isRefreshing) {
+      return this.refreshResult.pipe(
+        filter(refreshed => refreshed !== null),
+        take(1),
+        switchMap(refreshed => {
+          if (!refreshed) {
+            return throwError(() => new Error('Authentication renewal failed.'));
+          }
+
+          const retryRequest = this.prepareRequest(
+            request.clone({ headers: request.headers.set('X-Auth-Retry', '1') })
+          );
+
+          return next.handle(retryRequest);
+        })
+      );
+    }
+
+    this.isRefreshing = true;
+    this.refreshResult.next(null);
+
+    return accountService.refreshSession().pipe(
+      switchMap(() => {
+        this.isRefreshing = false;
+        this.refreshResult.next(true);
+        const retryRequest = this.prepareRequest(
+          request.clone({ headers: request.headers.set('X-Auth-Retry', '1') })
+        );
+
+        return next.handle(retryRequest);
+      }),
+      catchError(error => {
+        this.isRefreshing = false;
+        this.refreshResult.next(false);
+        accountService.clearAuthenticationState();
+        return throwError(error);
+      })
+    );
+  }
+}
diff --git a/src/Analysim.Web/ClientApp/src/app/interfaces/user.ts b/src/Analysim.Web/ClientApp/src/app/interfaces/user.ts
index 264956b0..4703543d 100644
--- a/src/Analysim.Web/ClientApp/src/app/interfaces/user.ts
+++ b/src/Analysim.Web/ClientApp/src/app/interfaces/user.ts
@@ -8,10 +8,12 @@ export interface User {
     email: string
     bio: string
     receiveCommentReplyEmails: boolean
+    lockoutEnabled: boolean
+    lockoutEnd?: string
     dateCreated: Date
     lastOnline: Date
     followers: Array<UserUser>
     following : Array<UserUser>
     projectUsers : Array<ProjectUser>
     blobFiles : Array<BlobFile>
-}
\ No newline at end of file
+}
diff --git a/src/Analysim.Web/ClientApp/src/app/login/login.component.ts b/src/Analysim.Web/ClientApp/src/app/login/login.component.ts
index 06349a09..fa894476 100644
--- a/src/Analysim.Web/ClientApp/src/app/login/login.component.ts
+++ b/src/Analysim.Web/ClientApp/src/app/login/login.component.ts
@@ -72,7 +72,6 @@ export class LoginComponent implements OnInit {
 
     this.acct.login(userLogin.username, userLogin.password).subscribe(
       result => {
-        let token = (<any>result).token;
         this.invalidLogin = false;
         this.loginForm.reset();
         this.router.navigateByUrl(this.returnUrl);
diff --git a/src/Analysim.Web/ClientApp/src/app/services/account.service.ts b/src/Analysim.Web/ClientApp/src/app/services/account.service.ts
index 4bbc27c6..05098757 100644
--- a/src/Analysim.Web/ClientApp/src/app/services/account.service.ts
+++ b/src/Analysim.Web/ClientApp/src/app/services/account.service.ts
@@ -1,9 +1,8 @@
 import { Injectable } from '@angular/core';
-import { HttpClient, HttpHeaders, HttpParams } from '@angular/common/http';
-import { BehaviorSubject, Observable, empty, throwError } from 'rxjs';
+import { HttpClient, HttpParams } from '@angular/common/http';
+import { BehaviorSubject, Observable, of, throwError } from 'rxjs';
 import { map, catchError } from 'rxjs/operators';
 import { Router } from '@angular/router';
-import jwt_decode from "jwt-decode";
 import { User } from '../interfaces/user';
 import { UserUser } from '../interfaces/user-user';
 import { NotificationService } from './notification.service';
@@ -15,7 +14,9 @@ import { BlobFile } from '../interfaces/blob-file';
 })
 export class AccountService {
 
-  constructor(private http: HttpClient, private router: Router, private notfi: NotificationService) { }
+  constructor(private http: HttpClient, private router: Router, private notfi: NotificationService) {
+    this.clearLegacyTokenStorage();
+  }
 
   // Url to access Web API
   private baseUrl: string = '/api/account/'
@@ -34,6 +35,9 @@ export class AccountService {
   private urlFollow: string = this.baseUrl + "follow"
   private urlRegister: string = this.baseUrl + "register"
   private urlLogin: string = this.baseUrl + "login"
+  private urlRefresh: string = this.baseUrl + "refresh"
+  private urlLogout: string = this.baseUrl + "logout"
+  private urlMe: string = this.baseUrl + "me"
   private urlUploadProfileImage: string = this.baseUrl + "uploadprofileimage"
 
   // Post
@@ -43,6 +47,7 @@ export class AccountService {
   private urlChangePassword: string = this.baseUrl + "changePassword"
   private urlReSendVerification: string = this.baseUrl + "sendConfirmationEmail"
   private urlUpdateNotificationPreferences: string = this.baseUrl + "updatenotificationpreferences/"
+  private urlSetAccountStatus: string = this.baseUrl + "setAccountStatus/"
 
   // Delete
   private urlUnfollow: string = this.baseUrl + "unfollow/"
@@ -57,7 +62,7 @@ export class AccountService {
   //User properties
   private loginStatus = new BehaviorSubject<boolean>(this.checkLoginStatus())
   private user = new BehaviorSubject<User>(null)
-  private userID = new BehaviorSubject<number>(parseInt(localStorage.getItem('userID')))
+  private userID = new BehaviorSubject<number>(this.getStoredUserID())
 
   getUserByID(userID: number): Observable<User> {
     return this.http.get<any>(this.urlGetUserByID + userID)
@@ -174,10 +179,7 @@ export class AccountService {
     body.append('userID', userID.toString())
     body.append('followerID', followerID.toString())
 
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-
-    return this.http.post<any>(this.urlFollow, body, {headers})
+    return this.http.post<any>(this.urlFollow, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -218,14 +220,8 @@ export class AccountService {
     return this.http.post<any>(this.urlLogin, body)
       .pipe(
         map(body => {
-          if (body && body.token) {
-            this.loginStatus.next(true)
-            this.user.next(body.result)
-            this.userID = new BehaviorSubject<number>(parseInt(body.result.id))
-            localStorage.setItem('loginStatus', '1')
-            localStorage.setItem('jwt', body.token)
-            localStorage.setItem('userID', body.result.id)
-            localStorage.setItem('expiration', body.expiration)
+          if (body && body.result) {
+            this.setAuthenticatedUser(body.result)
           }
           return body
         }),
@@ -314,9 +310,8 @@ export class AccountService {
     let body = new FormData()
     body.append('file', file)
     body.append('userID', userID.toString())
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
 
-    return this.http.post<any>(this.urlUploadProfileImage, body, {headers}).pipe(
+    return this.http.post<any>(this.urlUploadProfileImage, body).pipe(
       map(body => {
         console.log(body.message)
         return body.result
@@ -331,10 +326,8 @@ export class AccountService {
   updateUser(bio: string, userID: number): Observable<User> {
     let body = new FormData()
     body.append('bio', bio)
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
 
-    return this.http.put<any>(this.urlUpdateUser + userID, body, {headers})
+    return this.http.put<any>(this.urlUpdateUser + userID, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -352,12 +345,7 @@ export class AccountService {
       receiveCommentReplyEmails: receiveCommentReplyEmails
     };
     
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.put<any>(this.urlUpdateNotificationPreferences + userID, body, {headers})
+    return this.http.put<any>(this.urlUpdateNotificationPreferences + userID, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -371,9 +359,7 @@ export class AccountService {
   }
 
   unfollow(userID: number, followerID: number): Observable<UserUser> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.delete<any>(this.urlUnfollow + userID + '/' + followerID, {headers})
+    return this.http.delete<any>(this.urlUnfollow + userID + '/' + followerID)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -387,9 +373,7 @@ export class AccountService {
   }
 
   deleteProfileImage(blobFileID: number): Observable<BlobFile> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.delete<any>(this.urlDeleteProfileImage + blobFileID, {headers}).pipe(
+    return this.http.delete<any>(this.urlDeleteProfileImage + blobFileID).pipe(
       map(body => {
         console.log(body.message)
         return body.result
@@ -402,9 +386,7 @@ export class AccountService {
   }
 
   deleteUser(userID: number): Observable<any> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.delete<any>(this.urlDeleteUser + userID, {headers}).pipe(
+    return this.http.delete<any>(this.urlDeleteUser + userID).pipe(
       map(body => {
         console.log(body.message)
         return body.message
@@ -416,59 +398,66 @@ export class AccountService {
     );
   }
 
+  setAccountStatus(userID: number, disabled: boolean): Observable<User> {
+    return this.http.put<any>(this.urlSetAccountStatus + userID, { disabled }).pipe(
+      map(body => {
+        console.log(body.message)
+        return body.result
+      }),
+      catchError(error => {
+        console.log(error)
+        return throwError(error)
+      })
+    );
+  }
+
   checkLoginStatus(): boolean {
-    // Get Login Cookie
-    var loginCookie = localStorage.getItem('loginStatus');
-
-    // Check Login Cookie
-    // 0 = Not Logged In
-    // 1 = Logged In 
-    if (loginCookie == "1") {
-      // Return False If Null
-      if (localStorage.getItem('jwt') === null || localStorage.getItem('jwt') === undefined) {
-        return false;
-      }
-
-      // Get and Decode the Token
-      const token = localStorage.getItem('jwt');
-      const decoded: any = jwt_decode(token)
-
-      // Check if the cookie is valid
-      if (decoded.exp === undefined) {
-        return false;
-      }
-
-      // Get Current Time
-      const date = new Date(0)
-
-      // Convert Expiration to UTC
-      let tokenExpDate = date.setUTCSeconds(decoded.exp)
-
-      // Compare Expiration time with current time
-      if (tokenExpDate.valueOf() > new Date().valueOf()) {
-        return true;
-      }
-
-      // Return False Since Token Expire
-      this.user = new BehaviorSubject<User>(null)
-      return false;
-    }
-    this.user = new BehaviorSubject<User>(null)
-    return false;
+    return this.getCookie('analysim.logged_in') === '1';
   }
 
   logout() {
-    // Set Login Status to false
-    this.loginStatus.next(false)
+    this.http.post<any>(this.urlLogout, {})
+      .pipe(catchError(() => of(null)))
+      .subscribe(() => {
+        this.clearAuthenticationState()
+        this.router.navigate(['/login'])
+      })
+  }
 
-    // Remove item from localStorage
-    localStorage.setItem('loginStatus', '0')
-    localStorage.removeItem('jwt')
-    localStorage.removeItem('expiration')
-    localStorage.removeItem('userID')
+  refreshSession(): Observable<any> {
+    return this.http.post<any>(this.urlRefresh, {}).pipe(
+      map(body => {
+        if (body && body.result) {
+          this.setAuthenticatedUser(body.result)
+        }
+        return body
+      }),
+      catchError(error => {
+        this.clearAuthenticationState()
+        return throwError(error)
+      })
+    )
+  }
+
+  ensureAuthenticated(): Observable<boolean> {
+    if (this.loginStatus.value) {
+      return of(true)
+    }
+
+    return this.refreshSession().pipe(
+      map(() => true),
+      catchError(() => of(false))
+    )
+  }
 
-    // Navigate back to the login page
-    this.router.navigate(['/login'])
+  clearAuthenticationState(): void {
+    this.loginStatus.next(false)
+    this.user.next(null)
+    this.userID.next(null)
+    sessionStorage.removeItem('userID')
+    document.cookie = 'analysim.logged_in=; Max-Age=0; path=/; SameSite=Lax; Secure'
+    document.cookie = 'XSRF-TOKEN=; Max-Age=0; path=/; SameSite=Lax; Secure'
+    this.clearLegacyTokenStorage()
   }
 
   get isLoggedIn() {
@@ -476,9 +465,9 @@ export class AccountService {
   }
 
   get currentUser() {
-    if (this.userID.value != null && this.user.value == null && this.loginStatus.value == true) {
+    if (this.user.value == null && this.loginStatus.value == true) {
       let promise = new Promise<any>((resolve, reject) => {
-        this.getUserByID(this.userID.value)
+        this.getCurrentSessionUser()
           .toPromise()
           .then(
             body => {
@@ -505,6 +494,52 @@ export class AccountService {
     return this.userID.asObservable()
   }
 
+  private getCurrentSessionUser(): Observable<User> {
+    return this.http.get<any>(this.urlMe).pipe(
+      map(body => {
+        if (body && body.result) {
+          this.setAuthenticatedUser(body.result)
+          return body.result
+        }
+
+        return null
+      }),
+      catchError(error => {
+        this.clearAuthenticationState()
+        return throwError(error)
+      })
+    )
+  }
+
+  private setAuthenticatedUser(user: User): void {
+    this.loginStatus.next(true)
+    this.user.next(user)
+    this.userID.next(user ? user.id : null)
+    if (user) {
+      sessionStorage.setItem('userID', user.id.toString())
+    }
+  }
+
+  private getStoredUserID(): number {
+    const storedUserID = sessionStorage.getItem('userID')
+    return storedUserID ? parseInt(storedUserID) : null
+  }
+
+  private getCookie(name: string): string {
+    const cookie = document.cookie
+      .split('; ')
+      .find(row => row.startsWith(name + '='))
+
+    return cookie ? decodeURIComponent(cookie.split('=')[1]) : ''
+  }
+
+  private clearLegacyTokenStorage(): void {
+    localStorage.removeItem('jwt')
+    localStorage.removeItem('expiration')
+    localStorage.removeItem('loginStatus')
+    localStorage.removeItem('userID')
+  }
+
   // Error
   getProjectList(userID: number): Observable<ProjectUser[]> {
     return this.http.get<any>(this.urlGetProjects + userID)
diff --git a/src/Analysim.Web/ClientApp/src/app/services/project.service.ts b/src/Analysim.Web/ClientApp/src/app/services/project.service.ts
index 0d9011ef..4836a4b4 100644
--- a/src/Analysim.Web/ClientApp/src/app/services/project.service.ts
+++ b/src/Analysim.Web/ClientApp/src/app/services/project.service.ts
@@ -1,5 +1,5 @@
 import { Injectable } from '@angular/core';
-import { HttpClient, HttpHeaders, HttpParams } from '@angular/common/http';
+import { HttpClient, HttpParams } from '@angular/common/http';
 import { Router } from '@angular/router';
 import { map, catchError } from 'rxjs/operators';
 import { Observable, empty, throwError } from 'rxjs';
@@ -275,10 +275,7 @@ export class ProjectService {
     body.append('visibility', visibility)
     body.append('description', description)
     body.append('route', currentUser.userName + "/" + projectName)
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlCreateProject, body, {headers})
+    return this.http.post<any>(this.urlCreateProject, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -299,10 +296,7 @@ export class ProjectService {
       body.append('BlobFilesID', blobFilesID[i].toString())
     }
     body.getAll('BlobFilesID')
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlForkProject, body, {headers})
+    return this.http.post<any>(this.urlForkProject, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -319,10 +313,7 @@ export class ProjectService {
     let body = new FormData()
     body.append('userID', userID.toString())
     body.append('projectID', projectID.toString())
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlForkProjectWithoutBlob, body, {headers})
+    return this.http.post<any>(this.urlForkProjectWithoutBlob, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -343,10 +334,7 @@ export class ProjectService {
     body.append('userid', userID.toString())
     body.append('userrole', userRole)
     body.append('isFollowing', isFollowing ? 'true' : 'false')
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlAddUser, body, {headers})
+    return this.http.post<any>(this.urlAddUser, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -360,9 +348,7 @@ export class ProjectService {
   }
 
   followProject(projectID: number): Observable<ProjectUser> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlFollowProject + projectID, null, { headers }).pipe(
+    return this.http.post<any>(this.urlFollowProject + projectID, null).pipe(
       map(body => {
         console.log(body.message)
         return body.result
@@ -375,9 +361,7 @@ export class ProjectService {
   }
 
   unfollowProject(projectID: number): Observable<ProjectUser> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.delete<any>(this.urlUnfollowProject + projectID, { headers }).pipe(
+    return this.http.delete<any>(this.urlUnfollowProject + projectID).pipe(
       map(body => {
         console.log(body.message)
         return body.result
@@ -393,10 +377,7 @@ export class ProjectService {
     let body = new FormData()
     body.append('projectid', projectID.toString())
     body.append('tagname', tagName.toString())
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlAddTag, body, {headers})
+    return this.http.post<any>(this.urlAddTag, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -415,10 +396,7 @@ export class ProjectService {
     body.append('directory', directory)
     // body.append('userID', userID.toString())
     body.append('projectID', projectID.toString())
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlUploadFile, body, {headers}).pipe(
+    return this.http.post<any>(this.urlUploadFile, body).pipe(
       map(body => {
         console.log(body.result)
         return body.result
@@ -436,10 +414,7 @@ export class ProjectService {
     body.append('NotebookName', notebook.name);
     body.append('ProjectID', notebook.projectID.toString());
     body.append('directory', directory);
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlUploadNotebook, body, {headers}).pipe(
+    return this.http.post<any>(this.urlUploadNotebook, body).pipe(
       map(body => {
         console.log(body.result)
         return body.result
@@ -457,10 +432,7 @@ export class ProjectService {
     body.append('NotebookName', notebook.name);
     body.append('ProjectID', notebook.projectID.toString());
     body.append('directory', directory);
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlUploadNotebookNewVersion, body, {headers}).pipe(
+    return this.http.post<any>(this.urlUploadNotebookNewVersion, body).pipe(
       map(body => {
         console.log(body.message)
         return body.message
@@ -480,10 +452,7 @@ export class ProjectService {
     body.append('Type', notebookURL.type);
     body.append('observableNotebookDatasets', JSON.stringify(notebookURL.datasets));
     body.append('directory', directory);
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlUploadExistingNotebook, body, {headers}).pipe(
+    return this.http.post<any>(this.urlUploadExistingNotebook, body).pipe(
       map(body => {
         console.log(body.result)
         return body.result
@@ -500,10 +469,7 @@ export class ProjectService {
     body.append('directory', directory)
     // body.append('userID', userID.toString())
     body.append('projectID', projectID.toString())
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlCreateFolder, body, {headers}).pipe(
+    return this.http.post<any>(this.urlCreateFolder, body).pipe(
       map(body => {
         console.log(body.message)
         return body.result
@@ -520,10 +486,7 @@ export class ProjectService {
     body.append('directory', directory);
     body.append('folderName', folderName);
     body.append('projectID', projectID.toString());
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlCreateNotebookFolder, body, {headers}).pipe(
+    return this.http.post<any>(this.urlCreateNotebookFolder, body).pipe(
       map(body => {
         console.log(body.message)
         return body.result
@@ -540,10 +503,7 @@ export class ProjectService {
     body.append('notebookID', notebookID.toString());
     body.append('datasetName', `${file.name}${file.extension}`);
     body.append('blobFileID', file.blobFileID.toString());
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.post<any>(this.urlAddDatasetToNotebook, body, {headers}).pipe(
+    return this.http.post<any>(this.urlAddDatasetToNotebook, body).pipe(
       map(body => {
         console.log(body.message)
         return body.result
@@ -581,10 +541,7 @@ export class ProjectService {
     body.append('name', updateProject.name)
     body.append('visibility', updateProject.visibility)
     body.append('description', updateProject.description)
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.put<any>(this.urlUpdateProject + updateProject.projectID, body, {headers})
+    return this.http.put<any>(this.urlUpdateProject + updateProject.projectID, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -603,10 +560,7 @@ export class ProjectService {
     body.append('projectid', userRole.projectID.toString())
     body.append('userrole', userRole.userRole)
     body.append('isFollowing', userRole.isFollowing ? 'true' : 'false')
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.put<any>(this.urlupdateUser, body, {headers})
+    return this.http.put<any>(this.urlupdateUser, body)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -625,10 +579,7 @@ export class ProjectService {
     body.append('notebookID', notebookID.toString());
     body.append('blobFileID', file.blobFileID.toString());
     //console.log("calling delete dataset from notebook api");
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.put<any>(this.urlDeleteDatasetFromNotebook, body, {headers}).pipe(
+    return this.http.put<any>(this.urlDeleteDatasetFromNotebook, body).pipe(
       map(result => {
         console.log("after calling delete dataset from notebook : ", result.message)
         return result.result
@@ -643,10 +594,7 @@ export class ProjectService {
   deleteProject(projectID: number): Observable<Project> {
     let body = new FormData()
     // body.append('projectID', projectID.toString())
-
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.delete<any>(this.urlDeleteProject + projectID, {headers})
+    return this.http.delete<any>(this.urlDeleteProject + projectID)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -660,10 +608,8 @@ export class ProjectService {
   }
 
   removeUser(projectID: number, userID: number): Observable<ProjectUser> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
 
-    return this.http.delete<any>(this.urlRemoveUser + projectID + '/' + userID, {headers})
+    return this.http.delete<any>(this.urlRemoveUser + projectID + '/' + userID)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -678,10 +624,7 @@ export class ProjectService {
 
   removeTag(projectID: number, tagID: number): Observable<ProjectTag> {
 
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-
-    return this.http.delete<any>(this.urlRemoveTag + projectID + '/' + tagID, {headers})
+    return this.http.delete<any>(this.urlRemoveTag + projectID + '/' + tagID)
       .pipe(
         map(body => {
           console.log(body.message)
@@ -695,9 +638,7 @@ export class ProjectService {
   }
 
   deleteFile(blobFileID: number, isMember: boolean): Observable<BlobFile> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.delete<any>(this.urlDeleteFile + blobFileID + '/' + isMember, {headers})
+    return this.http.delete<any>(this.urlDeleteFile + blobFileID + '/' + isMember)
     .pipe(
       map(body => {
         console.log(body.message)
@@ -711,9 +652,7 @@ export class ProjectService {
   }
 
   deleteNotebook(notebookID: number, version: number, isMember: boolean): Observable<Notebook> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.delete<any>(this.urlDeleteNotebook + notebookID + '/' + version + '/' + isMember, {headers}).pipe(
+    return this.http.delete<any>(this.urlDeleteNotebook + notebookID + '/' + version + '/' + isMember).pipe(
       map(body => {
         console.log(body.message)
         return body.result
@@ -880,13 +819,7 @@ export class ProjectService {
     body.append('content', content);
     if(parentID != null) body.append('parentCommentID', parentID.toString());
     if(projectLogID != null) body.append('projectLogID', projectLogID.toString());
-
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.post<any>(this.urlPostComment, body, {headers}).pipe(
+    return this.http.post<any>(this.urlPostComment, body).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -901,13 +834,7 @@ export class ProjectService {
   updateComment(commentID: number, content: string): Observable<any> {
     let body = new FormData();
     body.append('content', content);
-
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.put<any>(this.urlUpdateComment + commentID, body, {headers}).pipe(
+    return this.http.put<any>(this.urlUpdateComment + commentID, body).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -920,12 +847,7 @@ export class ProjectService {
   }
 
   deleteComment(commentID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.put<any>(this.urlDeleteComment + commentID, null, {headers}).pipe(
+    return this.http.put<any>(this.urlDeleteComment + commentID, null).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -938,12 +860,7 @@ export class ProjectService {
   }
   
   likeComment(commentID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.post<any>(this.urlLikeComment + commentID, null, {headers}).pipe(
+    return this.http.post<any>(this.urlLikeComment + commentID, null).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -956,12 +873,7 @@ export class ProjectService {
   }
 
   unlikeComment(commentID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.delete<any>(this.urlUnlikeComment + commentID, {headers}).pipe(
+    return this.http.delete<any>(this.urlUnlikeComment + commentID).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -974,12 +886,7 @@ export class ProjectService {
   }
 
   reportComment(commentID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.post<any>(this.urlReportComment + commentID, null, {headers}).pipe(
+    return this.http.post<any>(this.urlReportComment + commentID, null).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -992,12 +899,7 @@ export class ProjectService {
   }
 
   removeCommentReport(commentID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.delete<any>(this.urlRemoveCommentReport + commentID, {headers}).pipe(
+    return this.http.delete<any>(this.urlRemoveCommentReport + commentID).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1010,12 +912,7 @@ export class ProjectService {
   }
 
   removeallCommentReports(commentID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.delete<any>(this.urlRemoveAllCommentReports + commentID, {headers}).pipe(
+    return this.http.delete<any>(this.urlRemoveAllCommentReports + commentID).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1028,9 +925,7 @@ export class ProjectService {
   }
 
   getFlaggedProjectComments(): Observable<FlaggedCommentGroup[]> {
-    const headers = new HttpHeaders().set('Authorization', `Bearer ${localStorage.getItem('jwt')}`);
-
-    return this.http.get<any>(this.urlGetFlaggedProjectComments, {headers}).pipe(
+    return this.http.get<any>(this.urlGetFlaggedProjectComments).pipe(
       map(body => {
         console.log(body.message);
         return body.result;
@@ -1043,12 +938,7 @@ export class ProjectService {
   }
 
   deleteCommentAndReports(commentID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.post<any>(this.urlDeleteCommentandReports + commentID, null, {headers}).pipe(
+    return this.http.post<any>(this.urlDeleteCommentandReports + commentID, null).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1075,12 +965,7 @@ export class ProjectService {
   }
 
   addPublication(formData: FormData): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.post<any>(this.urlAddPublication, formData, {headers}).pipe(
+    return this.http.post<any>(this.urlAddPublication, formData).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1093,12 +978,7 @@ export class ProjectService {
   }
 
   deletePublication(publicationId: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.delete<any>(this.urlDeletePublication + publicationId, {headers}).pipe(
+    return this.http.delete<any>(this.urlDeletePublication + publicationId).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1111,12 +991,7 @@ export class ProjectService {
   }
 
   updatePublication(formData: FormData, publicationId: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.put<any>(this.urlUpdatePublication + publicationId, formData, {headers}).pipe(
+    return this.http.put<any>(this.urlUpdatePublication + publicationId, formData).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1143,12 +1018,7 @@ export class ProjectService {
   }
 
   addProjectLog(formData: FormData): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.post<any>(this.urlAddProjectLog, formData, {headers}).pipe(
+    return this.http.post<any>(this.urlAddProjectLog, formData).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1161,12 +1031,7 @@ export class ProjectService {
   }
 
   updateProjectLog(formData: FormData, logId: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.put<any>(this.urlUpdateProjectLog + logId, formData, {headers}).pipe(
+    return this.http.put<any>(this.urlUpdateProjectLog + logId, formData).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1193,12 +1058,7 @@ export class ProjectService {
   }
 
   deleteProjectLog(logID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.put<any>(this.urlDeleteProjectLog + logID, null, {headers}).pipe(
+    return this.http.put<any>(this.urlDeleteProjectLog + logID, null).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1211,12 +1071,7 @@ export class ProjectService {
   }
 
   repostProjectLog(logID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.put<any>(this.urlRepostProjectLog + logID, null, {headers}).pipe(
+    return this.http.put<any>(this.urlRepostProjectLog + logID, null).pipe(
       map(body => {
         console.log(body.message);
         return body;
@@ -1229,12 +1084,7 @@ export class ProjectService {
   }
 
   getExpiredProjectLogs(): Observable<ExpiredProjectLog[]> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.get<any>(this.urlGetExpiredProjectLogs, {headers})
+    return this.http.get<any>(this.urlGetExpiredProjectLogs)
       .pipe(
         map(body => {
           console.log(body.message);
@@ -1248,12 +1098,7 @@ export class ProjectService {
   }
 
   deleteExpiredProjectLog(logID: number): Observable<any> {
-    const headers = new HttpHeaders().set(
-      'Authorization', 
-      `Bearer ${localStorage.getItem('jwt')}`
-    );
-
-    return this.http.delete<any>(this.urlDeleteExpiredProjectLog + logID, {headers}).pipe(
+    return this.http.delete<any>(this.urlDeleteExpiredProjectLog + logID).pipe(
       map(body => {
         console.log(body.message);
         return body;
diff --git a/src/Analysim.Web/Controllers/AccountController.cs b/src/Analysim.Web/Controllers/AccountController.cs
index 99f10e29..7573739f 100644
--- a/src/Analysim.Web/Controllers/AccountController.cs
+++ b/src/Analysim.Web/Controllers/AccountController.cs
@@ -5,6 +5,7 @@
 using Core.Interfaces;
 using Core.Services;
 using Infrastructure.Data;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
@@ -28,6 +29,7 @@
 using System.Data;
 using Analysim.Core.Entities;
 using Microsoft.AspNetCore.Authorization;
+using Web.Services;
 
 namespace Web.Controllers
 {
@@ -41,13 +43,15 @@ public class AccountController : ControllerBase
         private readonly ApplicationDbContext _dbContext;
         private readonly ILoggerManager _loggerManager;
         private readonly IMailNetService _mailNetService;
+        private readonly AuthTokenService _authTokenService;
 
         private readonly IConfiguration _configuration;
 
         public AccountController(IOptions<JwtSettings> jwtSettings, UserManager<User> userManager,
             SignInManager<User> signManager, ApplicationDbContext dbContext,
                                  ILoggerManager loggerManager,
-                                 IMailNetService mailNetService,IConfiguration configuration)
+                                 IMailNetService mailNetService,IConfiguration configuration,
+                                 AuthTokenService authTokenService)
         {
             _jwtSettings = jwtSettings.Value;
             _userManager = userManager;
@@ -56,6 +60,106 @@ public AccountController(IOptions<JwtSettings> jwtSettings, UserManager<User> us
             _loggerManager = loggerManager;
             _mailNetService = mailNetService;
             _configuration = configuration;
+            _authTokenService = authTokenService;
+        }
+
+        private const string AccessTokenCookieName = "analysim.access_token";
+        private const string RefreshTokenCookieName = "analysim.refresh_token";
+        private const string CsrfCookieName = "XSRF-TOKEN";
+        private const string LoggedInCookieName = "analysim.logged_in";
+
+        private string GetRequestIpAddress()
+        {
+            return HttpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown";
+        }
+
+        private void AppendAuthenticationCookies(AuthTokenResult tokenResult)
+        {
+            Response.Cookies.Append(AccessTokenCookieName, tokenResult.AccessToken, new CookieOptions
+            {
+                HttpOnly = true,
+                Secure = true,
+                SameSite = SameSiteMode.Lax,
+                Path = "/",
+                Expires = tokenResult.AccessTokenExpiresAt,
+                IsEssential = true
+            });
+
+            Response.Cookies.Append(RefreshTokenCookieName, tokenResult.RefreshToken, new CookieOptions
+            {
+                HttpOnly = true,
+                Secure = true,
+                SameSite = SameSiteMode.Lax,
+                Path = "/api/account",
+                Expires = tokenResult.RefreshTokenExpiresAt,
+                IsEssential = true
+            });
+
+            Response.Cookies.Append(CsrfCookieName, Guid.NewGuid().ToString("N"), new CookieOptions
+            {
+                HttpOnly = false,
+                Secure = true,
+                SameSite = SameSiteMode.Lax,
+                Path = "/",
+                Expires = tokenResult.RefreshTokenExpiresAt,
+                IsEssential = true
+            });
+
+            Response.Cookies.Append(LoggedInCookieName, "1", new CookieOptions
+            {
+                HttpOnly = false,
+                Secure = true,
+                SameSite = SameSiteMode.Lax,
+                Path = "/",
+                Expires = tokenResult.RefreshTokenExpiresAt,
+                IsEssential = true
+            });
+        }
+
+        private void ClearAuthenticationCookies()
+        {
+            var rootCookieOptions = new CookieOptions
+            {
+                Secure = true,
+                SameSite = SameSiteMode.Lax,
+                Path = "/"
+            };
+
+            Response.Cookies.Delete(AccessTokenCookieName, rootCookieOptions);
+            Response.Cookies.Delete(CsrfCookieName, rootCookieOptions);
+            Response.Cookies.Delete(LoggedInCookieName, rootCookieOptions);
+
+            Response.Cookies.Delete(RefreshTokenCookieName, new CookieOptions
+            {
+                Secure = true,
+                SameSite = SameSiteMode.Lax,
+                Path = "/api/account"
+            });
+        }
+
+        private async Task LoadUserNavigationsAsync(User user)
+        {
+            _dbContext.Entry(user).Collection(u => u.ProjectUsers).Load();
+            _dbContext.Entry(user).Collection(u => u.BlobFiles).Load();
+            _dbContext.Entry(user).Collection(u => u.Followers).Load();
+            _dbContext.Entry(user).Collection(u => u.Following).Load();
+            await Task.CompletedTask;
+        }
+
+        private bool IsUserDisabled(User user)
+        {
+            return user.LockoutEnd.HasValue && user.LockoutEnd.Value > DateTimeOffset.UtcNow;
+        }
+
+        private bool IsCurrentUserAdmin()
+        {
+            var currentUsername = User.Identity?.Name ?? User.FindFirstValue(ClaimTypes.Name);
+
+            var admins = _configuration
+                .GetSection("AdminUsers")
+                .Get<List<string>>() ?? new List<string>();
+
+            return admins.Any(u => string.Equals(u, currentUsername, StringComparison.OrdinalIgnoreCase));
         }
 
         #region GET REQUEST
@@ -295,8 +399,6 @@ public async Task<IActionResult> Register([FromForm] AccountRegisterVM formdata)
 
             string registrationCode = registrationSurveyJson.registrationCode;
 
-            Console.Write(registrationCode);
-
             if(registrationKeys != null && registrationKeys.Length != 0)
             {
                 bool containsRegistrationCode = registrationKeys.Contains(registrationCode);
@@ -531,7 +633,6 @@ public async Task<IActionResult> ForgotPassword([FromForm] ForgotPasswordVM form
             var code = await _userManager.GeneratePasswordResetTokenAsync(user);
             code = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(code));
 
-            System.Diagnostics.Debug.WriteLine(code);
             var callbackUrl = Url.Action("ResetPassword", "Account", 
             new { 
                 UserId = user.Id,
@@ -598,6 +699,9 @@ public async Task<IActionResult> changePassword([FromForm] ChangePasswordVM form
 
             if(resetPassResult.Result.Succeeded)
             {
+                await _authTokenService.RevokeAllUserRefreshTokensAsync(user.Id, GetRequestIpAddress(), "Password changed");
+                ClearAuthenticationCookies();
+
                 return Ok(new
                 {
                     result = resetPassResult.Result,
@@ -652,15 +756,6 @@ public async Task<IActionResult> Login([FromForm] AccountLoginVM formdata)
             var username = await _userManager.FindByNameAsync(formdata.Username);
             var email = await _userManager.FindByEmailAsync(formdata.Username);
 
-            // Get The User Role
-            //var roles = await _userManager.GetRolesAsync(user);
-
-            // Generate Key Token
-            var key = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(_jwtSettings.Secret));
-
-            // Generate Expiration Time For Token
-            double tokenExpiryTime = Convert.ToDouble(_jwtSettings.ExpireTime);
-
             // Check Login Status
             if ((username != null && await _userManager.CheckPasswordAsync(username, formdata.Password)) || (email != null && await _userManager.CheckPasswordAsync(email, formdata.Password)))
             {
@@ -668,6 +763,15 @@ public async Task<IActionResult> Login([FromForm] AccountLoginVM formdata)
                 if (email != null){
                     user = email;
                 }
+
+                if (IsUserDisabled(user))
+                {
+                    return Unauthorized(new
+                    {
+                        LoginError = "This account has been disabled. Please contact an administrator."
+                    });
+                }
+
                 // todo: link to resend verification email.
                 if (!await _userManager.IsEmailConfirmedAsync(user))
                 {
@@ -678,48 +782,22 @@ public async Task<IActionResult> Login([FromForm] AccountLoginVM formdata)
                     });
                 }
 
-                // Create JWT Token Handler
-                var tokenHandler = new JwtSecurityTokenHandler();
-
-                // Create Token Descriptor
-                var tokenDescriptor = new SecurityTokenDescriptor
-                {
-                    Subject = new ClaimsIdentity(new Claim[]
-                    {
-                        new Claim(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
-                        new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
-                        //new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
-                        //new Claim(ClaimTypes.Role, roles.FirstOrDefault()),
-                        new Claim("LoggedOn", DateTime.UtcNow.ToString()),
-                        new Claim(ClaimTypes.Name, formdata.Username)
-                    }),
-
-                    SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256Signature),
-                    Issuer = _jwtSettings.Issuer,
-                    Audience = _jwtSettings.Audience,
-                    Expires = DateTime.UtcNow.AddMinutes(tokenExpiryTime)
-                };
-
-                // Create Token
-                var token = tokenHandler.CreateToken(tokenDescriptor);
-
                 // Update Last Online
                 user.LastOnline = DateTime.UtcNow;
 
                 // Save Database Change
                 await _dbContext.SaveChangesAsync();
 
-                _dbContext.Entry(user).Collection(u => u.ProjectUsers).Load();
-                _dbContext.Entry(user).Collection(u => u.BlobFiles).Load();
-                _dbContext.Entry(user).Collection(u => u.Followers).Load();
-                _dbContext.Entry(user).Collection(u => u.Following).Load();
+                await LoadUserNavigationsAsync(user);
+
+                var tokenResult = await _authTokenService.CreateSessionAsync(user, GetRequestIpAddress());
+                AppendAuthenticationCookies(tokenResult);
 
                 // Return OK Request
                 return Ok(new
                 {
                     result = user,
-                    token = tokenHandler.WriteToken(token),
-                    expiration = token.ValidTo,
+                    expiration = tokenResult.AccessTokenExpiresAt,
                     message = "Login successful"
                 });
 
@@ -737,6 +815,139 @@ public async Task<IActionResult> Login([FromForm] AccountLoginVM formdata)
             }
         }
 
+        /*
+         * Type : GET
+         * URL : /api/account/me
+         * Description: Return the authenticated user for the current access-token cookie
+         * Response Status: 200 Ok, 401 Unauthorized
+         */
+        [Authorize]
+        [HttpGet("[action]")]
+        public async Task<IActionResult> Me()
+        {
+            var userIdClaim = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+            if (string.IsNullOrEmpty(userIdClaim) || !int.TryParse(userIdClaim, out var userId))
+            {
+                return Unauthorized(new { message = "Invalid user identifier." });
+            }
+
+            var user = await _dbContext.Users.SingleOrDefaultAsync(u => u.Id == userId);
+            if (user == null)
+            {
+                return Unauthorized(new { message = "User not found." });
+            }
+
+            await LoadUserNavigationsAsync(user);
+
+            return Ok(new
+            {
+                result = user,
+                message = "Session is active"
+            });
+        }
+
+        /*
+         * Type : POST
+         * URL : /api/account/refresh
+         * Description: Rotate a valid refresh-token cookie and issue fresh authentication cookies
+         * Response Status: 200 Ok, 401 Unauthorized
+         */
+        [HttpPost("[action]")]
+        public async Task<IActionResult> Refresh()
+        {
+            if (!Request.Cookies.TryGetValue(RefreshTokenCookieName, out var refreshToken))
+            {
+                ClearAuthenticationCookies();
+                return Unauthorized(new { message = "Authentication renewal failed." });
+            }
+
+            var tokenResult = await _authTokenService.RotateRefreshTokenAsync(refreshToken, GetRequestIpAddress());
+            if (tokenResult == null)
+            {
+                ClearAuthenticationCookies();
+                return Unauthorized(new { message = "Authentication renewal failed." });
+            }
+
+            await LoadUserNavigationsAsync(tokenResult.User);
+            AppendAuthenticationCookies(tokenResult);
+
+            return Ok(new
+            {
+                result = tokenResult.User,
+                expiration = tokenResult.AccessTokenExpiresAt,
+                message = "Authentication renewed"
+            });
+        }
+
+        /*
+         * Type : POST
+         * URL : /api/account/logout
+         * Description: Revoke the current refresh token and clear authentication cookies
+         * Response Status: 200 Ok
+         */
+        [HttpPost("[action]")]
+        public async Task<IActionResult> Logout()
+        {
+            if (Request.Cookies.TryGetValue(RefreshTokenCookieName, out var refreshToken))
+            {
+                await _authTokenService.RevokeRefreshTokenAsync(refreshToken, GetRequestIpAddress(), "User logged out");
+            }
+
+            ClearAuthenticationCookies();
+
+            return Ok(new { message = "Logout successful" });
+        }
+
+        /*
+         * Type : PUT
+         * URL : /api/account/setaccountstatus/{userId}
+         * Description: Disable or enable a user account from the admin panel
+         * Response Status: 200 Ok, 400 Bad Request, 403 Forbidden, 404 Not Found
+         */
+        [Authorize]
+        [HttpPut("[action]/{userId:int}")]
+        public async Task<IActionResult> SetAccountStatus([FromRoute] int userId, [FromBody] AccountStatusUpdateVM formdata)
+        {
+            var currentUserIdStr = User.FindFirstValue(ClaimTypes.NameIdentifier);
+            if (!int.TryParse(currentUserIdStr, out var currentUserId))
+            {
+                return Unauthorized(new { message = "Invalid user identity." });
+            }
+
+            if (!IsCurrentUserAdmin())
+            {
+                return Forbid();
+            }
+
+            if (formdata.Disabled && currentUserId == userId)
+            {
+                return BadRequest(new { message = "Administrators cannot disable their own account." });
+            }
+
+            var user = await _dbContext.Users.SingleOrDefaultAsync(u => u.Id == userId);
+            if (user == null)
+            {
+                return NotFound(new { message = "User not found." });
+            }
+
+            user.LockoutEnabled = true;
+            user.LockoutEnd = formdata.Disabled ? DateTimeOffset.MaxValue : null;
+
+            if (formdata.Disabled)
+            {
+                await _authTokenService.RevokeAllUserRefreshTokensAsync(user.Id, GetRequestIpAddress(), "User account disabled by administrator");
+            }
+
+            await _dbContext.SaveChangesAsync();
+            await LoadUserNavigationsAsync(user);
+
+            return Ok(new
+            {
+                result = user,
+                message = formdata.Disabled ? "User account disabled." : "User account enabled."
+            });
+        }
+
 
 
         /*
@@ -1064,6 +1275,7 @@ public async Task<IActionResult> DeleteUser([FromRoute] int userId)
                 await _dbContext.SaveChangesAsync();
 
                 // Remove the user
+                await _authTokenService.RevokeAllUserRefreshTokensAsync(userId, GetRequestIpAddress(), "User account deleted");
                 _dbContext.Users.Remove(user);
                 await _dbContext.SaveChangesAsync();
 
diff --git a/src/Analysim.Web/Extensions/ServiceExtensions.cs b/src/Analysim.Web/Extensions/ServiceExtensions.cs
index 7fd1cb8d..acf21b68 100644
--- a/src/Analysim.Web/Extensions/ServiceExtensions.cs
+++ b/src/Analysim.Web/Extensions/ServiceExtensions.cs
@@ -12,6 +12,9 @@
 using System;
 using System.Text;
 using Core.Interfaces;
+using Microsoft.AspNetCore.Http;
+using System.Linq;
+using Web.Services;
 
 namespace Web.Extensions
 {
@@ -23,7 +26,12 @@ public static void ConfigureCors(this IServiceCollection services)
             services.AddCors(options =>
             {
                 options.AddPolicy("CorsPolicy", builder =>
-                    builder.AllowAnyOrigin()
+                    builder.WithOrigins(
+                        "https://localhost:5001",
+                        "http://localhost:5000",
+                        "https://localhost:4200",
+                        "http://localhost:4200")
+                    .AllowCredentials()
                     .AllowAnyMethod()
                     .AllowAnyHeader());
             });
@@ -97,9 +105,28 @@ public static void ConfigureJWT(this IServiceCollection services, IConfiguration
 
                     ValidIssuer = jwtSettings.GetSection("Issuer").Value,
                     ValidAudience = jwtSettings.GetSection("Audience").Value,
-                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey))
+                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey)),
+                    ClockSkew = TimeSpan.FromMinutes(1)
+                };
+
+                options.Events = new JwtBearerEvents
+                {
+                    OnMessageReceived = context =>
+                    {
+                        var hasBearerHeader = context.Request.Headers.ContainsKey("Authorization")
+                            && context.Request.Headers["Authorization"].Any(h => h.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase));
+
+                        if (!hasBearerHeader && context.Request.Cookies.TryGetValue("analysim.access_token", out var accessToken))
+                        {
+                            context.Token = accessToken;
+                        }
+
+                        return System.Threading.Tasks.Task.CompletedTask;
+                    }
                 };
             });
+
+            services.AddScoped<AuthTokenService>();
         }
 
         public static void ConfigureSpa(this IServiceCollection services)
diff --git a/src/Analysim.Web/Services/AuthTokenResult.cs b/src/Analysim.Web/Services/AuthTokenResult.cs
new file mode 100644
index 00000000..db6de4d0
--- /dev/null
+++ b/src/Analysim.Web/Services/AuthTokenResult.cs
@@ -0,0 +1,18 @@
+using System;
+using Core.Entities;
+
+namespace Web.Services
+{
+    public class AuthTokenResult
+    {
+        public User User { get; set; }
+
+        public string AccessToken { get; set; }
+
+        public DateTime AccessTokenExpiresAt { get; set; }
+
+        public string RefreshToken { get; set; }
+
+        public DateTime RefreshTokenExpiresAt { get; set; }
+    }
+}
diff --git a/src/Analysim.Web/Services/AuthTokenService.cs b/src/Analysim.Web/Services/AuthTokenService.cs
new file mode 100644
index 00000000..c36219b4
--- /dev/null
+++ b/src/Analysim.Web/Services/AuthTokenService.cs
@@ -0,0 +1,221 @@
+using Core.Entities;
+using Core.Helper;
+using Infrastructure.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+using System;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Security.Cryptography;
+using System.Text;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace Web.Services
+{
+    public class AuthTokenService
+    {
+        private readonly ApplicationDbContext _dbContext;
+        private readonly JwtSettings _jwtSettings;
+
+        public AuthTokenService(ApplicationDbContext dbContext, IOptions<JwtSettings> jwtSettings)
+        {
+            _dbContext = dbContext;
+            _jwtSettings = jwtSettings.Value;
+        }
+
+        public async Task<AuthTokenResult> CreateSessionAsync(User user, string ipAddress)
+        {
+            var refreshToken = GenerateRefreshToken();
+            var refreshTokenHash = HashToken(refreshToken);
+            var refreshExpiresAt = DateTime.UtcNow.AddDays(GetRefreshTokenLifetimeDays());
+
+            await _dbContext.RefreshTokens.AddAsync(new RefreshToken
+            {
+                UserID = user.Id,
+                TokenHash = refreshTokenHash,
+                TokenFamilyID = Guid.NewGuid(),
+                CreatedAt = DateTime.UtcNow,
+                ExpiresAt = refreshExpiresAt,
+                CreatedByIp = ipAddress
+            });
+
+            await _dbContext.SaveChangesAsync();
+
+            return CreateTokenResult(user, refreshToken, refreshExpiresAt);
+        }
+
+        public async Task<AuthTokenResult> RotateRefreshTokenAsync(string refreshToken, string ipAddress)
+        {
+            if (string.IsNullOrWhiteSpace(refreshToken))
+            {
+                return null;
+            }
+
+            var tokenHash = HashToken(refreshToken);
+            var storedToken = await _dbContext.RefreshTokens
+                .Include(rt => rt.User)
+                .SingleOrDefaultAsync(rt => rt.TokenHash == tokenHash);
+
+            if (storedToken == null)
+            {
+                return null;
+            }
+
+            if (!storedToken.IsActive)
+            {
+                await RevokeTokenFamilyAsync(storedToken.TokenFamilyID, ipAddress, "Refresh token reuse detected");
+                return null;
+            }
+
+            if (storedToken.User.LockoutEnd.HasValue && storedToken.User.LockoutEnd.Value > DateTimeOffset.UtcNow)
+            {
+                await RevokeTokenFamilyAsync(storedToken.TokenFamilyID, ipAddress, "User account disabled");
+                return null;
+            }
+
+            var replacementToken = GenerateRefreshToken();
+            var replacementHash = HashToken(replacementToken);
+            var replacementExpiresAt = DateTime.UtcNow.AddDays(GetRefreshTokenLifetimeDays());
+
+            storedToken.RevokedAt = DateTime.UtcNow;
+            storedToken.RevokedByIp = ipAddress;
+            storedToken.RevokedReason = "Replaced by rotated refresh token";
+            storedToken.ReplacedByTokenHash = replacementHash;
+
+            await _dbContext.RefreshTokens.AddAsync(new RefreshToken
+            {
+                UserID = storedToken.UserID,
+                TokenHash = replacementHash,
+                TokenFamilyID = storedToken.TokenFamilyID,
+                CreatedAt = DateTime.UtcNow,
+                ExpiresAt = replacementExpiresAt,
+                CreatedByIp = ipAddress
+            });
+
+            await _dbContext.SaveChangesAsync();
+
+            return CreateTokenResult(storedToken.User, replacementToken, replacementExpiresAt);
+        }
+
+        public async Task RevokeRefreshTokenAsync(string refreshToken, string ipAddress, string reason)
+        {
+            if (string.IsNullOrWhiteSpace(refreshToken))
+            {
+                return;
+            }
+
+            var tokenHash = HashToken(refreshToken);
+            var storedToken = await _dbContext.RefreshTokens.SingleOrDefaultAsync(rt => rt.TokenHash == tokenHash);
+
+            if (storedToken == null || storedToken.IsRevoked)
+            {
+                return;
+            }
+
+            storedToken.RevokedAt = DateTime.UtcNow;
+            storedToken.RevokedByIp = ipAddress;
+            storedToken.RevokedReason = reason;
+
+            await _dbContext.SaveChangesAsync();
+        }
+
+        public async Task RevokeAllUserRefreshTokensAsync(int userId, string ipAddress, string reason)
+        {
+            var tokens = await _dbContext.RefreshTokens
+                .Where(rt => rt.UserID == userId && rt.RevokedAt == null)
+                .ToListAsync();
+
+            foreach (var token in tokens)
+            {
+                token.RevokedAt = DateTime.UtcNow;
+                token.RevokedByIp = ipAddress;
+                token.RevokedReason = reason;
+            }
+
+            await _dbContext.SaveChangesAsync();
+        }
+
+        public static string HashToken(string token)
+        {
+            using var sha256 = SHA256.Create();
+            var bytes = sha256.ComputeHash(Encoding.UTF8.GetBytes(token));
+            return Convert.ToBase64String(bytes);
+        }
+
+        private async Task RevokeTokenFamilyAsync(Guid tokenFamilyId, string ipAddress, string reason)
+        {
+            var activeFamilyTokens = await _dbContext.RefreshTokens
+                .Where(rt => rt.TokenFamilyID == tokenFamilyId && rt.RevokedAt == null)
+                .ToListAsync();
+
+            foreach (var token in activeFamilyTokens)
+            {
+                token.RevokedAt = DateTime.UtcNow;
+                token.RevokedByIp = ipAddress;
+                token.RevokedReason = reason;
+            }
+
+            await _dbContext.SaveChangesAsync();
+        }
+
+        private AuthTokenResult CreateTokenResult(User user, string refreshToken, DateTime refreshExpiresAt)
+        {
+            var accessTokenExpiresAt = DateTime.UtcNow.AddMinutes(GetAccessTokenLifetimeMinutes());
+
+            return new AuthTokenResult
+            {
+                User = user,
+                AccessToken = CreateAccessToken(user, accessTokenExpiresAt),
+                AccessTokenExpiresAt = accessTokenExpiresAt,
+                RefreshToken = refreshToken,
+                RefreshTokenExpiresAt = refreshExpiresAt
+            };
+        }
+
+        private string CreateAccessToken(User user, DateTime expiresAt)
+        {
+            var key = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(_jwtSettings.Secret));
+            var tokenHandler = new JwtSecurityTokenHandler();
+            var tokenDescriptor = new SecurityTokenDescriptor
+            {
+                Subject = new ClaimsIdentity(new[]
+                {
+                    new Claim(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
+                    new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+                    new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
+                    new Claim("LoggedOn", DateTime.UtcNow.ToString("O")),
+                    new Claim(ClaimTypes.Name, user.UserName)
+                }),
+                SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256Signature),
+                Issuer = _jwtSettings.Issuer,
+                Audience = _jwtSettings.Audience,
+                Expires = expiresAt
+            };
+
+            return tokenHandler.WriteToken(tokenHandler.CreateToken(tokenDescriptor));
+        }
+
+        private static string GenerateRefreshToken()
+        {
+            var randomBytes = RandomNumberGenerator.GetBytes(64);
+            return Base64UrlEncoder.Encode(randomBytes);
+        }
+
+        private double GetAccessTokenLifetimeMinutes()
+        {
+            if (double.TryParse(_jwtSettings.ExpireTime, out var minutes) && minutes > 0)
+            {
+                return minutes;
+            }
+
+            return 10;
+        }
+
+        private int GetRefreshTokenLifetimeDays()
+        {
+            return _jwtSettings.RefreshTokenExpireDays > 0 ? _jwtSettings.RefreshTokenExpireDays : 14;
+        }
+    }
+}
diff --git a/src/Analysim.Web/Startup.cs b/src/Analysim.Web/Startup.cs
index e4814af3..c3c9243d 100644
--- a/src/Analysim.Web/Startup.cs
+++ b/src/Analysim.Web/Startup.cs
@@ -2,12 +2,15 @@
 using Core.Interfaces;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.SpaServices.AngularCli;
 using Microsoft.AspNetCore.StaticFiles;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
+using System;
+using System.Linq;
 using Microsoft.OpenApi;
 using Web.Extensions;
 
@@ -121,6 +124,43 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILoggerM
 
             app.UseRouting();
 
+            app.Use(async (context, next) =>
+            {
+                var method = context.Request.Method;
+                var isUnsafeApiRequest = context.Request.Path.StartsWithSegments("/api")
+                    && !HttpMethods.IsGet(method)
+                    && !HttpMethods.IsHead(method)
+                    && !HttpMethods.IsOptions(method)
+                    && !HttpMethods.IsTrace(method);
+
+                var usesAuthCookie = context.Request.Cookies.ContainsKey("analysim.access_token")
+                    || context.Request.Cookies.ContainsKey("analysim.refresh_token");
+
+                var path = context.Request.Path.Value?.ToLowerInvariant() ?? string.Empty;
+                var isPublicAuthRequest = path == "/api/account/login"
+                    || path == "/api/account/register"
+                    || path == "/api/account/forgotpassword"
+                    || path == "/api/account/changepassword"
+                    || path == "/api/account/confirmemailpost";
+
+                if (isUnsafeApiRequest && usesAuthCookie && !isPublicAuthRequest)
+                {
+                    var csrfCookie = context.Request.Cookies["XSRF-TOKEN"];
+                    var csrfHeader = context.Request.Headers["X-XSRF-TOKEN"].FirstOrDefault();
+
+                    if (string.IsNullOrWhiteSpace(csrfCookie)
+                        || string.IsNullOrWhiteSpace(csrfHeader)
+                        || !string.Equals(csrfCookie, csrfHeader, StringComparison.Ordinal))
+                    {
+                        context.Response.StatusCode = StatusCodes.Status400BadRequest;
+                        await context.Response.WriteAsJsonAsync(new { message = "Invalid CSRF token." });
+                        return;
+                    }
+                }
+
+                await next();
+            });
+
             app.UseAuthentication();
             app.UseAuthorization();
 
diff --git a/src/Analysim.Web/ViewModels/Account/AccountStatusUpdateVM.cs b/src/Analysim.Web/ViewModels/Account/AccountStatusUpdateVM.cs
new file mode 100644
index 00000000..23914f87
--- /dev/null
+++ b/src/Analysim.Web/ViewModels/Account/AccountStatusUpdateVM.cs
@@ -0,0 +1,7 @@
+namespace Web.ViewModels.Account
+{
+    public class AccountStatusUpdateVM
+    {
+        public bool Disabled { get; set; }
+    }
+}