mckaragoz · Oct 12, 2026 · Oct 12, 2026
diff --git a/src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionIssuanceContext.cs b/src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionIssuanceContext.cs
@@ -1,5 +1,6 @@
 using CodeBeam.UltimateAuth.Core.Domain;
 using CodeBeam.UltimateAuth.Core.MultiTenancy;
+using CodeBeam.UltimateAuth.Core.Options;
 
 namespace CodeBeam.UltimateAuth.Core.Contracts;
 
@@ -16,6 +17,7 @@ public sealed class SessionIssuanceContext
     public ClaimsSnapshot? Claims { get; init; }
     public required SessionMetadata Metadata { get; init; }
     public required UAuthMode Mode { get; init; }
+    public required UAuthSessionOptions SessionOptions { get; init; }
 
     /// <summary>
     /// Optional chain identifier.

diff --git a/src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionRotationContext.cs b/src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionRotationContext.cs
@@ -1,5 +1,6 @@
 using CodeBeam.UltimateAuth.Core.Domain;
 using CodeBeam.UltimateAuth.Core.MultiTenancy;
+using CodeBeam.UltimateAuth.Core.Options;
 
 namespace CodeBeam.UltimateAuth.Core.Contracts;
 
@@ -13,4 +14,5 @@ public sealed record SessionRotationContext
     public ClaimsSnapshot? Claims { get; init; }
     public required SessionMetadata Metadata { get; init; } = SessionMetadata.Empty;
     public required UAuthMode Mode { get; init; }
+    public required UAuthSessionOptions SessionOptions { get; init; }
 }
diff --git a/src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionValidationContext.cs b/src/CodeBeam.UltimateAuth.Core/Contracts/Session/SessionValidationContext.cs
@@ -1,5 +1,6 @@
 using CodeBeam.UltimateAuth.Core.Domain;
 using CodeBeam.UltimateAuth.Core.MultiTenancy;
+using CodeBeam.UltimateAuth.Core.Options;
 
 namespace CodeBeam.UltimateAuth.Core.Contracts;
 
@@ -9,4 +10,9 @@ public sealed record SessionValidationContext
     public AuthSessionId SessionId { get; init; }
     public DateTimeOffset Now { get; init; }
     public required DeviceContext Device { get; init; }
+
+    /// <summary>
+    /// Required session options for validation. Remote session validators may not include.
+    /// </summary>
+    public UAuthSessionOptions? SessionOptions { get; init; }
 }
diff --git a/src/CodeBeam.UltimateAuth.Server/Auth/Context/AuthFlowContext.cs b/src/CodeBeam.UltimateAuth.Server/Auth/Context/AuthFlowContext.cs
@@ -21,8 +21,7 @@ public sealed class AuthFlowContext
     public bool IsAuthenticated { get; }
     public UserKey? UserKey { get; }
 
-    public UAuthServerOptions OriginalOptions { get; }
-    public EffectiveUAuthServerOptions EffectiveOptions { get; }
+    public UAuthServerOptions Options { get; }
 
     public EffectiveAuthResponse Response { get; }
     public ReturnUrlInfo ReturnUrlInfo { get; }
@@ -46,8 +45,7 @@ internal AuthFlowContext(
         bool isAuthenticated,
         UserKey? userKey,
         SessionSecurityContext? session,
-        UAuthServerOptions originalOptions,
-        EffectiveUAuthServerOptions effectiveOptions,
+        UAuthServerOptions options,
         EffectiveAuthResponse response,
         PrimaryTokenKind primaryTokenKind,
         ReturnUrlInfo returnUrlInfo)
@@ -65,8 +63,7 @@ internal AuthFlowContext(
         IsAuthenticated = isAuthenticated;
         UserKey = userKey;
 
-        OriginalOptions = originalOptions;
-        EffectiveOptions = effectiveOptions;
+        Options = options;
 
         Response = response;
         PrimaryTokenKind = primaryTokenKind;

diff --git a/src/CodeBeam.UltimateAuth.Server/Auth/Context/AuthFlowContextFactory.cs b/src/CodeBeam.UltimateAuth.Server/Auth/Context/AuthFlowContextFactory.cs
@@ -2,7 +2,6 @@
 using CodeBeam.UltimateAuth.Core.Contracts;
 using CodeBeam.UltimateAuth.Core.Domain;
 using CodeBeam.UltimateAuth.Core.Infrastructure;
-using CodeBeam.UltimateAuth.Core.MultiTenancy;
 using CodeBeam.UltimateAuth.Core.Options;
 using CodeBeam.UltimateAuth.Server.Abstractions;
 using CodeBeam.UltimateAuth.Server.Extensions;
@@ -50,19 +49,20 @@ public async ValueTask<AuthFlowContext> CreateAsync(HttpContext ctx, AuthFlowTyp
         var user = ctx.GetUserContext();
 
         var clientProfile = await _clientProfileReader.ReadAsync(ctx);
-        var originalOptions = _serverOptionsProvider.GetOriginal(ctx);
-        var effectiveOptions = _serverOptionsProvider.GetEffective(ctx, flowType, clientProfile);
 
-        var allowedModes = originalOptions.AllowedModes;
+        var effective = _serverOptionsProvider.GetEffective(ctx, clientProfile);
+        var options = effective.Options;
 
-        if (allowedModes is { Count: > 0 } && !allowedModes.Contains(effectiveOptions.Mode))
+        var effectiveMode = effective.Mode;
+        var allowedModes = options.AllowedModes;
+
+        if (allowedModes is { Count: > 0 } && !allowedModes.Contains(effectiveMode))
         {
-            throw new InvalidOperationException($"Auth mode '{effectiveOptions.Mode}' is not allowed by server configuration.");
+            throw new InvalidOperationException($"Auth mode '{effectiveMode}' is not allowed by server configuration.");
         }
 
-        var effectiveMode = effectiveOptions.Mode;
         var primaryTokenKind = _primaryTokenResolver.Resolve(effectiveMode);
-        var response = _authResponseResolver.Resolve(effectiveMode, flowType, clientProfile, effectiveOptions);
+        var response = _authResponseResolver.Resolve(effectiveMode, flowType, clientProfile, effective);
         var deviceInfo = await _deviceResolver.ResolveAsync(ctx);
         var deviceContext = _deviceContextFactory.Create(deviceInfo);
         var returnUrl = await ctx.GetReturnUrlAsync();
@@ -78,6 +78,7 @@ public async ValueTask<AuthFlowContext> CreateAsync(HttpContext ctx, AuthFlowTyp
                     Tenant = tenant,
                     SessionId = sessionCtx.SessionId!.Value,
                     Device = deviceContext,
+                    SessionOptions = options.Session,
                     Now = _clock.UtcNow
                 },
                 ct);
@@ -100,8 +101,7 @@ public async ValueTask<AuthFlowContext> CreateAsync(HttpContext ctx, AuthFlowTyp
             user?.IsAuthenticated ?? false,
             user?.UserId,
             sessionSecurityContext,
-            originalOptions,
-            effectiveOptions,
+            options,
             response,
             primaryTokenKind,
             returnUrlInfo
@@ -113,19 +113,19 @@ public async ValueTask<AuthFlowContext> RecreateWithClientProfileAsync(AuthFlowC
         var flowType = existing.FlowType;
         var tenant = existing.Tenant;
 
-        var originalOptions = existing.OriginalOptions;
-        var effectiveOptions = _serverOptionsProvider.GetEffective(tenant, flowType, overriddenProfile);
+        var effective = _serverOptionsProvider.GetEffective(tenant, overriddenProfile);
+        var options = effective.Options;
+        var effectiveMode = effective.Mode;
 
-        var allowedModes = originalOptions.AllowedModes;
+        var allowedModes = options.AllowedModes;
 
-        if (allowedModes is { Count: > 0 } && !allowedModes.Contains(effectiveOptions.Mode))
+        if (allowedModes is { Count: > 0 } && !allowedModes.Contains(effectiveMode))
         {
-            throw new InvalidOperationException($"Auth mode '{effectiveOptions.Mode}' is not allowed by server configuration.");
+            throw new InvalidOperationException($"Auth mode '{effectiveMode}' is not allowed by server configuration.");
         }
 
-        var effectiveMode = effectiveOptions.Mode;
         var primaryTokenKind = _primaryTokenResolver.Resolve(effectiveMode);
-        var response = _authResponseResolver.Resolve(effectiveMode, flowType, overriddenProfile, effectiveOptions);
+        var response = _authResponseResolver.Resolve(effectiveMode, flowType, overriddenProfile, effective);
 
         var returnUrlInfo = existing.ReturnUrlInfo;
         var deviceContext = existing.Device;
@@ -140,8 +140,7 @@ public async ValueTask<AuthFlowContext> RecreateWithClientProfileAsync(AuthFlowC
             existing.IsAuthenticated,
             existing.UserKey,
             session,
-            originalOptions,
-            effectiveOptions,
+            options,
             response,
             primaryTokenKind,
             returnUrlInfo
@@ -162,8 +161,7 @@ public ValueTask<AuthFlowContext> RecreateWithDeviceAsync(AuthFlowContext existi
             existing.IsAuthenticated,
             existing.UserKey,
             existing.Session,
-            existing.OriginalOptions,
-            existing.EffectiveOptions,
+            existing.Options,
             existing.Response,
             existing.PrimaryTokenKind,
             existing.ReturnUrlInfo

diff --git a/src/CodeBeam.UltimateAuth.Server/Auth/EffectiveServerOptionsProvider.cs b/src/CodeBeam.UltimateAuth.Server/Auth/EffectiveServerOptionsProvider.cs
@@ -24,16 +24,16 @@ public UAuthServerOptions GetOriginal(HttpContext context)
         return _baseOptions.Value;
     }
 
-    public EffectiveUAuthServerOptions GetEffective(HttpContext context, AuthFlowType flowType, UAuthClientProfile clientProfile)
+    public EffectiveUAuthServerOptions GetEffective(HttpContext context, UAuthClientProfile clientProfile)
     {
         var tenant = context.GetTenant();
-        return GetEffective(tenant, flowType, clientProfile);
+        return GetEffective(tenant, clientProfile);
     }
 
-    public EffectiveUAuthServerOptions GetEffective(TenantKey tenant, AuthFlowType flowType, UAuthClientProfile clientProfile)
+    public EffectiveUAuthServerOptions GetEffective(TenantKey tenant, UAuthClientProfile clientProfile)
     {
         var original = _baseOptions.Value;
-        var effectiveMode = _modeResolver.Resolve(clientProfile, flowType);
+        var effectiveMode = _modeResolver.Resolve(clientProfile);
         var options = original.Clone();
 
         ConfigureDefaults.ApplyModeDefaults(effectiveMode, options);

diff --git a/src/CodeBeam.UltimateAuth.Server/Auth/Response/EffectiveAuthModeResolver.cs b/src/CodeBeam.UltimateAuth.Server/Auth/Response/EffectiveAuthModeResolver.cs
@@ -6,7 +6,7 @@ namespace CodeBeam.UltimateAuth.Server.Auth;
 
 internal sealed class EffectiveAuthModeResolver : IEffectiveAuthModeResolver
 {
-    public UAuthMode Resolve(UAuthClientProfile clientProfile, AuthFlowType flowType)
+    public UAuthMode Resolve(UAuthClientProfile clientProfile)
     {
         return clientProfile switch
         {

diff --git a/src/CodeBeam.UltimateAuth.Server/Auth/Response/IEffectiveAuthModeResolver.cs b/src/CodeBeam.UltimateAuth.Server/Auth/Response/IEffectiveAuthModeResolver.cs
@@ -6,5 +6,5 @@ namespace CodeBeam.UltimateAuth.Server.Auth;
 
 public interface IEffectiveAuthModeResolver
 {
-    UAuthMode Resolve(UAuthClientProfile clientProfile, AuthFlowType flowType);
+    UAuthMode Resolve(UAuthClientProfile clientProfile);
 }
diff --git a/src/CodeBeam.UltimateAuth.Server/Authentication/AspNetCore/UAuthAuthenticationHandler.cs b/src/CodeBeam.UltimateAuth.Server/Authentication/AspNetCore/UAuthAuthenticationHandler.cs
@@ -61,6 +61,7 @@ protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
                 Tenant = tenant,
                 SessionId = sessionId,
                 Device = _deviceContextFactory.Create(credential.Device),
+                SessionOptions = _serverOptions.Session,
                 Now = _clock.UtcNow
             });
 

diff --git a/...eBeam.UltimateAuth.Server/Authentication/AspNetCore/UAuthResourceAuthenticationHandler.cs b/...eBeam.UltimateAuth.Server/Authentication/AspNetCore/UAuthResourceAuthenticationHandler.cs
@@ -1,8 +1,10 @@
 using CodeBeam.UltimateAuth.Core.Abstractions;
 using CodeBeam.UltimateAuth.Core.Contracts;
 using CodeBeam.UltimateAuth.Core.Domain;
+using CodeBeam.UltimateAuth.Server.Auth;
 using CodeBeam.UltimateAuth.Server.Extensions;
 using CodeBeam.UltimateAuth.Server.Infrastructure;
+using CodeBeam.UltimateAuth.Server.Options;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;

diff --git a/src/CodeBeam.UltimateAuth.Server/Endpoints/PkceEndpointHandler.cs b/src/CodeBeam.UltimateAuth.Server/Endpoints/PkceEndpointHandler.cs
@@ -297,7 +297,7 @@ public async Task<IResult> CompleteAsync(HttpContext ctx)
 
     private async Task<IResult> RedirectToLoginWithErrorAsync(HttpContext ctx, AuthFlowContext auth, string error)
     {
-        var basePath = auth.OriginalOptions.Hub.LoginPath ?? "/login";
+        var basePath = auth.Options.Hub.LoginPath ?? "/login";
         var hubKey = await ResolveHubKeyAsync(ctx);
 
         if (!string.IsNullOrWhiteSpace(hubKey))

diff --git a/src/CodeBeam.UltimateAuth.Server/Endpoints/RefreshEndpointHandler.cs b/src/CodeBeam.UltimateAuth.Server/Endpoints/RefreshEndpointHandler.cs
@@ -72,7 +72,7 @@ public async Task<IResult> RefreshAsync(HttpContext ctx)
             _credentialWriter.Write(ctx, GrantKind.RefreshToken, result.RefreshToken);
         }
 
-        if (flow.OriginalOptions.Diagnostics.EnableRefreshDetails)
+        if (flow.Options.Diagnostics.EnableRefreshDetails)
         {
             _refreshWriter.Write(ctx, result.Outcome);
         }

diff --git a/src/CodeBeam.UltimateAuth.Server/Endpoints/ValidateEndpointHandler.cs b/src/CodeBeam.UltimateAuth.Server/Endpoints/ValidateEndpointHandler.cs
@@ -67,7 +67,8 @@ public async Task<IResult> ValidateAsync(HttpContext context, CancellationToken
                     Tenant = tenant,
                     SessionId = sessionId,
                     Now = _clock.UtcNow,
-                    Device = auth.Device
+                    Device = auth.Device,
+                    SessionOptions = auth.Options.Session
                 },
                 ct);
 

diff --git a/src/CodeBeam.UltimateAuth.Server/Extensions/UAuthApplicationBuilderExtensions.cs b/src/CodeBeam.UltimateAuth.Server/Extensions/UAuthApplicationBuilderExtensions.cs
@@ -60,7 +60,7 @@ public static IApplicationBuilder UseUltimateAuthResourceApi(this IApplicationBu
         app.UseUAuthExceptionHandling();
         app.UseMiddleware<TenantMiddleware>();
         app.UseMiddleware<SessionResolutionMiddleware>();
-        app.UseMiddleware<SessionValidationMiddleware>();
+        app.UseMiddleware<RemoteSessionValidationMiddleware>();
         app.UseMiddleware<UserMiddleware>();
 
         return app;

diff --git a/src/CodeBeam.UltimateAuth.Server/Flows/Login/LoginOrchestrator.cs b/src/CodeBeam.UltimateAuth.Server/Flows/Login/LoginOrchestrator.cs
@@ -30,7 +30,6 @@ internal sealed class LoginOrchestrator : ILoginOrchestrator, IInternalLoginOrch
     private readonly ISessionStoreFactory _storeFactory;
     private readonly IAuthenticationSecurityManager _authenticationSecurityManager; // runtime risk
     private readonly UAuthEventDispatcher _events;
-    private readonly UAuthServerOptions _options;
     private readonly IClock _clock;
 
     public LoginOrchestrator(
@@ -44,7 +43,6 @@ public LoginOrchestrator(
         ISessionStoreFactory storeFactory,
         IAuthenticationSecurityManager authenticationSecurityManager,
         UAuthEventDispatcher events,
-        IOptions<UAuthServerOptions> options,
         IClock clock)
     {
         _identifierResolver = identifierResolver;
@@ -57,7 +55,6 @@ public LoginOrchestrator(
         _storeFactory = storeFactory;
         _authenticationSecurityManager = authenticationSecurityManager;
         _events = events;
-        _options = options.Value;
         _clock = clock;
     }
 
@@ -136,7 +133,7 @@ public async Task<LoginResult> LoginAsync(AuthFlowContext flow, LoginRequest req
 
             if (chain is not null)
             {
-                var chainState = chain.GetState(now, _options.Session.IdleTimeout);
+                var chainState = chain.GetState(now, flow.Options.Session.IdleTimeout);
 
                 if (chainState == SessionState.Active)
                 {
@@ -174,14 +171,14 @@ public async Task<LoginResult> LoginAsync(AuthFlowContext flow, LoginRequest req
                         request.CredentialType,
                         state => state.RegisterFailure(
                             now,
-                            _options.Login.MaxFailedAttempts,
-                            _options.Login.LockoutDuration,
-                            _options.Login.FailureWindow,
-                            _options.Login.ExtendLockOnFailure),
+                            flow.Options.Login.MaxFailedAttempts,
+                            flow.Options.Login.LockoutDuration,
+                            flow.Options.Login.FailureWindow,
+                            flow.Options.Login.ExtendLockOnFailure),
                         ct);
                 }
 
-                if (_options.Login.IncludeFailureDetails)
+                if (flow.Options.Login.IncludeFailureDetails)
                 {
                     var stateForResponse = factorState;
 
@@ -190,9 +187,9 @@ public async Task<LoginResult> LoginAsync(AuthFlowContext flow, LoginRequest req
                         lockedUntil = stateForResponse.LockedUntil;
                         remainingAttempts = 0;
                     }
-                    else if (_options.Login.MaxFailedAttempts > 0)
+                    else if (flow.Options.Login.MaxFailedAttempts > 0)
                     {
-                        remainingAttempts = _options.Login.MaxFailedAttempts - stateForResponse.FailedAttempts;
+                        remainingAttempts = flow.Options.Login.MaxFailedAttempts - stateForResponse.FailedAttempts;
                     }
                 }
 
@@ -247,7 +244,8 @@ public async Task<LoginResult> LoginAsync(AuthFlowContext flow, LoginRequest req
             Claims = claims,
             ChainId = chainId,
             Metadata = SessionMetadata.Empty,
-            Mode = flow.EffectiveMode
+            Mode = flow.EffectiveMode,
+            SessionOptions = flow.Options.Session
         };
 
         var authContext = flow.ToAuthContext(now);

diff --git a/src/CodeBeam.UltimateAuth.Server/Infrastructure/Cookies/UAuthCookiePolicyBuilder.cs b/src/CodeBeam.UltimateAuth.Server/Infrastructure/Cookies/UAuthCookiePolicyBuilder.cs
@@ -34,7 +34,7 @@ private static SameSiteMode ResolveSameSite(UAuthCookieOptions cookie, AuthFlowC
         if (cookie.SameSite is not null)
             return cookie.SameSite.Value;
 
-        return context.OriginalOptions.HubDeploymentMode switch
+        return context.Options.HubDeploymentMode switch
         {
             UAuthHubDeploymentMode.Embedded => SameSiteMode.Strict,
             UAuthHubDeploymentMode.Integrated => SameSiteMode.Lax,
@@ -65,16 +65,16 @@ private static void ApplyLifetime(CookieOptions target, UAuthCookieOptions src,
         return kind switch
         {
             GrantKind.Session => ResolveSessionLifetime(context),
-            GrantKind.RefreshToken => context.EffectiveOptions.Options.Token.RefreshTokenLifetime,
-            GrantKind.AccessToken => context.EffectiveOptions.Options.Token.AccessTokenLifetime,
+            GrantKind.RefreshToken => context.Options.Token.RefreshTokenLifetime,
+            GrantKind.AccessToken => context.Options.Token.AccessTokenLifetime,
             _ => null
         };
     }
 
     private static TimeSpan? ResolveSessionLifetime(AuthFlowContext context)
     {
-        var sessionIdle = context.EffectiveOptions.Options.Session.IdleTimeout;
-        var refresh = context.EffectiveOptions.Options.Token.RefreshTokenLifetime;
+        var sessionIdle = context.Options.Session.IdleTimeout;
+        var refresh = context.Options.Token.RefreshTokenLifetime;
 
         return context.EffectiveMode switch
         {