diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/.template.config/template.json b/src/Templates/Boilerplate/Bit.Boilerplate/.template.config/template.json
index 47da6004a7..3506c9f76c 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/.template.config/template.json
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/.template.config/template.json
@@ -541,6 +541,9 @@
                         "src/Tests/Features/Identity/TwoFactorAuthTests.cs",
                         "src/Tests/Features/Identity/PrivilegedSessionTests.cs",
                         "src/Tests/Features/Identity/RefreshTokenRotationTests.cs",
+                        "src/Tests/Features/Identity/ReturnUrlHardeningTests.cs",
+                        "src/Tests/Features/Identity/OneTimeTokenTests.cs",
+                        "src/Tests/Features/Identity/ConfirmPageTwoFactorTests.cs",
                         "src/Tests/Features/Identity/UserGroupFeatureManagementUITests.cs",
                         "src/Tests/Features/Seo/**",
                         "src/Tests/Features/Tenants/TenantInvitationUITests.cs",
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/ConfirmPage.razor.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/ConfirmPage.razor.cs
index f8e334db6c..bdcbbf53ba 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/ConfirmPage.razor.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/ConfirmPage.razor.cs
@@ -31,6 +31,8 @@ public partial class ConfirmPage
     [Parameter, SupplyParameterFromQuery(Name = "phoneToken")]
     public string? PhoneTokenQueryString { get; set; }
 
+    private string GetSafeReturnUrl() => Uri.IsAppRelativeUrl(ReturnUrlQueryString, requireLeadingSlash: false) ? ReturnUrlQueryString : PageUrls.Home;
+
 
     protected override async Task OnInitAsync()
     {
@@ -84,9 +86,18 @@ await WrapRequest(async () =>
                 Token = emailModel.Token
             }, CurrentCancellationToken);
 
+            if (signInResponse.RequiresTwoFactor)
+            {
+                // The e-mail is confirmed, but the automatic sign-in needs a second factor this page cannot collect
+                // (ConfirmEmailRequestDto carries no code). Storing the response would overwrite the caller's tokens
+                // with nulls, so show the "confirmed, now sign in" panel instead.
+                isEmailConfirmed = true;
+                return;
+            }
+
             await AuthManager.StoreTokens(signInResponse, true);
 
-            NavigationManager.NavigateTo(ReturnUrlQueryString ?? PageUrls.Home, replace: true);
+            NavigationManager.NavigateTo(GetSafeReturnUrl(), replace: true);
 
             isEmailConfirmed = true;
         });
@@ -98,7 +109,7 @@ private async Task ResendEmailToken()
 
         await WrapRequest(async () =>
         {
-            await identityController.SendConfirmEmailToken(new() { Email = emailModel.Email, ReturnUrl = ReturnUrlQueryString }, CurrentCancellationToken);
+            await identityController.SendConfirmEmailToken(new() { Email = emailModel.Email, ReturnUrl = GetSafeReturnUrl() }, CurrentCancellationToken);
         });
     }
 
@@ -114,9 +125,16 @@ await WrapRequest(async () =>
                 PhoneNumber = phoneModel.PhoneNumber
             }, CurrentCancellationToken);
 
+            if (signInResponse.RequiresTwoFactor)
+            {
+                // See the note in ConfirmEmail above.
+                isPhoneConfirmed = true;
+                return;
+            }
+
             await AuthManager.StoreTokens(signInResponse, true);
 
-            NavigationManager.NavigateTo(ReturnUrlQueryString ?? PageUrls.Home, replace: true);
+            NavigationManager.NavigateTo(GetSafeReturnUrl(), replace: true);
 
             isPhoneConfirmed = true;
         });
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/SignIn/SignInPanel.razor b/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/SignIn/SignInPanel.razor
index 7b70823bd2..04b0a0f84a 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/SignIn/SignInPanel.razor
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/SignIn/SignInPanel.razor
@@ -68,7 +68,7 @@
                                                     <BitStack Horizontal VerticalAlign="BitAlignment.Center">
                                                         <BitText>@Localizer[nameof(AppStrings.Password)]</BitText>
                                                         <BitSpacer />
-                                                        <BitLink Href="@($"{PageUrls.ForgotPassword}?return-url={Uri.EscapeDataString(GetReturnUrl())}")">@Localizer[nameof(AppStrings.ForgotPasswordLink)]</BitLink>
+                                                        <BitLink Href="@($"{PageUrls.ForgotPassword}?return-url={Uri.EscapeDataString(GetSafeReturnUrl())}")">@Localizer[nameof(AppStrings.ForgotPasswordLink)]</BitLink>
                                                     </BitStack>
                                                 </LabelTemplate>
                                             </BitTextField>
@@ -138,7 +138,7 @@
                                 {
                                     <BitText Align="BitTextAlign.Center" Typography="BitTypography.Body2">
                                         @Localizer[nameof(AppStrings.DontHaveAccountMessage)]
-                                        <BitLink Href="@($"{PageUrls.SignUp}?return-url={Uri.EscapeDataString(GetReturnUrl())}")">@Localizer[nameof(AppStrings.SignUp)]</BitLink>
+                                        <BitLink Href="@($"{PageUrls.SignUp}?return-url={Uri.EscapeDataString(GetSafeReturnUrl())}")">@Localizer[nameof(AppStrings.SignUp)]</BitLink>
                                     </BitText>
                                 }
                             </BitStack>
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/SignIn/SignInPanel.razor.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/SignIn/SignInPanel.razor.cs
index e3c8afe3c6..63ba077fc6 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/SignIn/SignInPanel.razor.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/Identity/SignIn/SignInPanel.razor.cs
@@ -18,7 +18,12 @@ public partial class SignInPanel
     private SignInPanelType internalSignInPanelType;
     private readonly SignInRequestDto model = new();
     private AppDataAnnotationsValidator? validatorRef;
-    private string GetReturnUrl() => ReturnUrl ?? ReturnUrlQueryString ?? PageUrls.Home;
+    private string GetSafeReturnUrl()
+    {
+        var returnUrl = ReturnUrl ?? ReturnUrlQueryString;
+
+        return Uri.IsAppRelativeUrl(returnUrl, requireLeadingSlash: false) ? returnUrl : PageUrls.Home;
+    }
 
     [Parameter]
     public string? ReturnUrl { get; set; }
@@ -143,7 +148,7 @@ private async Task DoSignIn()
 
                 if (isNewUser is false)
                 {
-                    model.ReturnUrl = GetReturnUrl();
+                    model.ReturnUrl = GetSafeReturnUrl();
 
                     requiresTwoFactor = await AuthManager.SignIn(model, CurrentCancellationToken);
 
@@ -187,7 +192,7 @@ private async Task DoSignIn()
                 }
                 else
                 {
-                    NavigationManager.NavigateTo(GetReturnUrl(), replace: true);
+                    NavigationManager.NavigateTo(GetSafeReturnUrl(), replace: true);
                 }
             }
         }
@@ -231,7 +236,7 @@ private async Task ExternalSignIn(string provider)
 
                 queryParams.TryGetValue("return-url", out var returnUrl);
                 var returnUrlValue = GetValue(returnUrl);
-                ReturnUrlQueryString = Uri.IsAppRelativeUrl(returnUrlValue) ? returnUrlValue : PageUrls.Home;
+                ReturnUrlQueryString = Uri.IsAppRelativeUrl(returnUrlValue, requireLeadingSlash: false) ? returnUrlValue : PageUrls.Home;
                 queryParams.TryGetValue("userName", out var userName);
                 UserNameQueryString = GetValue(userName);
                 queryParams.TryGetValue("email", out var email);
@@ -248,7 +253,7 @@ private async Task ExternalSignIn(string provider)
 
             var port = localHttpServer.EnsureStarted();
 
-            var redirectUrl = await identityController.GetExternalSignInUri(provider, GetReturnUrl(), port is -1 ? null : port, CurrentCancellationToken);
+            var redirectUrl = await identityController.GetExternalSignInUri(provider, GetSafeReturnUrl(), port is -1 ? null : port, CurrentCancellationToken);
 
             await externalNavigationService.NavigateTo(redirectUrl);
         }
@@ -324,7 +329,7 @@ private async Task SendOtp(bool resend)
 
             var request = new IdentityRequestDto { UserName = model.UserName, Email = model.Email, PhoneNumber = model.PhoneNumber };
 
-            await identityController.SendOtp(request, GetReturnUrl(), CurrentCancellationToken);
+            await identityController.SendOtp(request, GetSafeReturnUrl(), CurrentCancellationToken);
 
             isOtpSent = true;
         }
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/NotAuthorizedPage.razor.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/NotAuthorizedPage.razor.cs
index f53e3a21b3..0ba7646731 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/NotAuthorizedPage.razor.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Components/Pages/NotAuthorizedPage.razor.cs
@@ -9,6 +9,7 @@ public partial class NotAuthorizedPage
     [SupplyParameterFromQuery(Name = "return-url"), Parameter]
     public string? ReturnUrl { get; set; }
 
+    private string GetSafeReturnUrl() => Uri.IsAppRelativeUrl(ReturnUrl, requireLeadingSlash: false) ? ReturnUrl : PageUrls.Home;
 
     [AutoInject] private SignInModalService signInModalService = default!;
 
@@ -28,9 +29,10 @@ protected override async Task OnAfterFirstRenderAsync()
                 var accessToken = await AuthManager.RefreshToken(requestedBy: nameof(NotAuthorizedPage));
                 if (string.IsNullOrEmpty(accessToken) is false && ReturnUrl is not null && ReturnUrl.Contains("try_refreshing_token=false", StringComparison.InvariantCulture) is false)
                 {
+                    var returnUrl = GetSafeReturnUrl();
                     // To prevent infinities redirect loop, let's append try_refreshing_token=false to the url, so we only redirect in case no try_refreshing_token=false is present
-                    var @char = ReturnUrl.Contains('?') ? '&' : '?'; // The RedirectUrl may already include a query string.
-                    NavigationManager.NavigateTo($"{ReturnUrl}{@char}try_refreshing_token=false", replace: true);
+                    var @char = returnUrl.Contains('?') ? '&' : '?'; // The RedirectUrl may already include a query string.
+                    NavigationManager.NavigateTo($"{returnUrl}{@char}try_refreshing_token=false", replace: true);
                 }
             }
 
@@ -48,7 +50,7 @@ protected override async Task OnAfterFirstRenderAsync()
     private async Task SignIn()
     {
         await AuthManager.SignOut(CurrentCancellationToken);
-        var returnUrl = ReturnUrl ?? NavigationManager.GetRelativePath();
+        var returnUrl = ReturnUrl is null ? NavigationManager.GetRelativePath() : GetSafeReturnUrl();
         await signInModalService.SignIn(returnUrl);
 
         // Alternatively, you can redirect the user to the sign-in page.
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.EmailConfirmation.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.EmailConfirmation.cs
index 63e888d3a7..426776d2a3 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.EmailConfirmation.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.EmailConfirmation.cs
@@ -28,7 +28,8 @@ public async Task ConfirmEmail(ConfirmEmailRequestDto request, CancellationToken
         var user = await userManager.FindByEmailAsync(request.Email!)
             ?? throw new BadRequestException(Localizer[nameof(AppStrings.UserNotFound)]).WithData("Email", request.Email);
 
-        var expired = (TimeProvider.GetUtcNow() - user.EmailTokenRequestedOn) > AppSettings.Identity.EmailTokenLifetime;
+        var expired = user.EmailTokenRequestedOn is null ||
+                      (TimeProvider.GetUtcNow() - user.EmailTokenRequestedOn.Value) > AppSettings.Identity.EmailTokenLifetime;
 
         if (expired)
             throw new BadRequestException(nameof(AppStrings.ExpiredToken)).WithData("UserId", user.Id);
@@ -39,7 +40,7 @@ public async Task ConfirmEmail(ConfirmEmailRequestDto request, CancellationToken
             throw new BadRequestException(Localizer[nameof(AppStrings.UserLockedOut), (TimeProvider.GetUtcNow() - user.LockoutEnd!).Value.Humanize(culture: CultureInfo.CurrentUICulture)]).WithData("UserId", user.Id).WithExtensionData("TryAgainIn", tryAgainIn);
         }
 
-        var tokenIsValid = await userManager.VerifyUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, FormattableString.Invariant($"VerifyEmail:{request.Email},{user.EmailTokenRequestedOn?.ToUniversalTime()}"), request.Token!);
+        var tokenIsValid = await userManager.VerifyUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, FormattableString.Invariant($"VerifyEmail:{user.Email},{user.EmailTokenRequestedOn?.ToUniversalTime()}"), request.Token!);
 
         if (tokenIsValid is false)
         {
@@ -66,7 +67,10 @@ public async Task ConfirmEmail(ConfirmEmailRequestDto request, CancellationToken
 
     private async Task SendConfirmEmailToken(User user, string? returnUrl, CancellationToken cancellationToken)
     {
-        returnUrl ??= PageUrls.Home;
+        if (Uri.IsAppRelativeUrl(returnUrl, requireLeadingSlash: false) is false)
+        {
+            returnUrl = PageUrls.Home;
+        }
 
         var resendDelay = (TimeProvider.GetUtcNow() - user.EmailTokenRequestedOn) - AppSettings.Identity.EmailTokenLifetime;
 
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ExternalSignIn.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ExternalSignIn.cs
index 4486095c65..3a4e09c32c 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ExternalSignIn.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ExternalSignIn.cs
@@ -11,8 +11,9 @@ public partial class IdentityController
 
     /// <summary>
     /// Deliberately not cached: the returned URL embeds the caller's origin, which GetWebAppUrl resolves from the X-Origin
-    /// header. That header is part of neither the output cache's vary rules nor a CDN's cache key, so a cached response would
-    /// hand one origin's sign-in URL to a caller coming from another, sending the resulting sign-in link to the wrong origin.
+    /// header. The output cache does vary by that header (See AppResponseCachePolicy.CacheRequestAsync), but a CDN edge
+    /// does not unless it is configured to, so a shared-cached response would hand one origin's sign-in URL to a caller
+    /// coming from another, sending the resulting sign-in link to the wrong origin.
     /// </summary>
     [HttpGet]
     public async Task<string> GetExternalSignInUri(string provider, string? returnUrl = null, int? localHttpPort = null, CancellationToken cancellationToken = default)
@@ -38,6 +39,9 @@ public async Task<ActionResult> ExternalSignInCallback(string? returnUrl = null,
         string? signInPageUri;
         ExternalLoginInfo? info = null;
 
+        if (localHttpPort is not null and (< 1 or > 65535))
+            throw new BadRequestException().WithData("localHttpPort", localHttpPort);
+
         try
         {
             info = await signInManager.GetExternalLoginInfoAsync() ?? throw new BadRequestException().WithData("Reason", "External login info is missing.");
@@ -46,11 +50,15 @@ public async Task<ActionResult> ExternalSignInCallback(string? returnUrl = null,
 
             var user = await userManager.FindByLoginAsync(info.LoginProvider, info.ProviderKey);
 
+            var isLinked = user is not null;
+
             if (user is null && (string.IsNullOrEmpty(email) is false || string.IsNullOrEmpty(phoneNumber) is false))
             {
                 user = await userManager.FindUser(new() { Email = email, PhoneNumber = phoneNumber });
             }
 
+            var isNewUser = user is null;
+
             if (user is null)
             {
                 var name = info.Principal.FindFirstValue("preferred_username") ?? info.Principal.FindFirstValue(ClaimTypes.Name) ?? info.Principal.FindFirstValue(ClaimTypes.NameIdentifier) ?? info.Principal.FindFirstValue("name");
@@ -86,8 +94,24 @@ public async Task<ActionResult> ExternalSignInCallback(string? returnUrl = null,
                     // Therefore, we assign a role to these users by default.
                     await userManager.CreateUserWithDemoRole(user);
                 }
+            }
 
-                await userManager.AddLoginAsync(user, info);
+            if (isLinked is false)
+            {
+                var addLoginResult = await userManager.AddLoginAsync(user, info);
+
+                if (addLoginResult.Succeeded is false)
+                {
+                    if (isNewUser)
+                    {
+                        // Only this request could reach that row: a provider asserting neither an email nor a phone
+                        // number leaves the identifier fallback above nothing to match it by, so without the login it
+                        // would be unreachable forever and every retry would add another one.
+                        await userManager.DeleteAsync(user);
+                    }
+
+                    throw new ResourceValidationException(addLoginResult.Errors.Select(e => new LocalizedString(e.Code, e.Description)).ToArray()).WithData("UserId", user.Id);
+                }
             }
 
             // Confirmation is only as good as the provider's own verification of the identifier
@@ -130,7 +154,11 @@ public async Task<ActionResult> ExternalSignInCallback(string? returnUrl = null,
         }
         catch (Exception exp)
         {
-            serverExceptionHandler.Handle(exp, new() { { "LoginProvider", info?.LoginProvider }, { "Principal", info?.Principal?.GetDisplayName() } });
+            var principalName = info?.Principal?.FindFirstValue("preferred_username")
+                                ?? info?.Principal?.GetEmail()
+                                ?? info?.Principal?.FindFirstValue(ClaimTypes.NameIdentifier);
+
+            serverExceptionHandler.Handle(exp, new() { { "LoginProvider", info?.LoginProvider }, { "Principal", principalName } });
             signInPageUri = $"{PageUrls.SignIn}?error={Uri.EscapeDataString(exp is KnownException ? Localizer[exp.Message] : Localizer[nameof(AppStrings.UnknownException)])}";
         }
         finally
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.PhoneConfirmation.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.PhoneConfirmation.cs
index 28ef99bf5f..5119abfa44 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.PhoneConfirmation.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.PhoneConfirmation.cs
@@ -30,7 +30,8 @@ public async Task ConfirmPhone(ConfirmPhoneRequestDto request, CancellationToken
         var user = await userManager.FindByPhoneNumber(request.PhoneNumber!)
             ?? throw new BadRequestException(Localizer[nameof(AppStrings.UserNotFound)]).WithData("PhoneNumber", request.PhoneNumber);
 
-        var expired = (TimeProvider.GetUtcNow() - user.PhoneNumberTokenRequestedOn) > AppSettings.Identity.PhoneNumberTokenLifetime;
+        var expired = user.PhoneNumberTokenRequestedOn is null ||
+                      (TimeProvider.GetUtcNow() - user.PhoneNumberTokenRequestedOn.Value) > AppSettings.Identity.PhoneNumberTokenLifetime;
 
         if (expired)
             throw new BadRequestException(nameof(AppStrings.ExpiredToken)).WithData("UserId", user.Id);
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ResetPassword.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ResetPassword.cs
index c09ad99671..9e4736d6f3 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ResetPassword.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ResetPassword.cs
@@ -39,7 +39,8 @@ public async Task SendResetPasswordToken(SendResetPasswordTokenRequestDto reques
         var token = await userManager.GenerateUserTokenAsync(user, TokenOptions.DefaultPhoneProvider, FormattableString.Invariant($"ResetPassword,{user.ResetPasswordTokenRequestedOn?.ToUniversalTime()}"));
         var isEmail = string.IsNullOrEmpty(request.Email) is false;
         var qs = $"{(isEmail ? "email" : "phoneNumber")}={Uri.EscapeDataString(isEmail ? request.Email! : request.PhoneNumber!)}";
-        var url = $"{PageUrls.ResetPassword}?token={Uri.EscapeDataString(token)}&{qs}&culture={CultureInfo.CurrentUICulture.Name}&return-url={Uri.EscapeDataString(request.ReturnUrl ?? PageUrls.Home)}";
+        var returnUrl = Uri.IsAppRelativeUrl(request.ReturnUrl, requireLeadingSlash: false) ? request.ReturnUrl : PageUrls.Home;
+        var url = $"{PageUrls.ResetPassword}?token={Uri.EscapeDataString(token)}&{qs}&culture={CultureInfo.CurrentUICulture.Name}&return-url={Uri.EscapeDataString(returnUrl)}";
         var link = new Uri(HttpContext.Request.GetWebAppUrl(), url);
 
         List<Task> sendMessagesTasks = [];
@@ -82,7 +83,8 @@ public async Task ResetPassword(ResetPasswordRequestDto request, CancellationTok
         request.PhoneNumber = phoneService.NormalizePhoneNumber(request.PhoneNumber);
         var user = await userManager.FindUser(request) ?? throw new ResourceNotFoundException(Localizer[nameof(AppStrings.UserNotFound)]).WithData("Identifier", request);
 
-        var expired = (TimeProvider.GetUtcNow() - user.ResetPasswordTokenRequestedOn) > AppSettings.Identity.ResetPasswordTokenLifetime;
+        var expired = user.ResetPasswordTokenRequestedOn is null ||
+                      (TimeProvider.GetUtcNow() - user.ResetPasswordTokenRequestedOn.Value) > AppSettings.Identity.ResetPasswordTokenLifetime;
 
         if (expired)
             throw new BadRequestException(nameof(AppStrings.ExpiredToken)).WithData("UserId", user.Id);
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/Services/RemoteAuthenticationOptionsConfigurator.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/Services/RemoteAuthenticationOptionsConfigurator.cs
index d5fa3ddbc3..641ccaffea 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/Services/RemoteAuthenticationOptionsConfigurator.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/Services/RemoteAuthenticationOptionsConfigurator.cs
@@ -10,15 +10,25 @@
 namespace Boilerplate.Server.Api.Features.Identity.Services;
 
 /// <summary>
-/// Configures External Identity Providers BackchannelHttpHandler to use Microsoft.Extensions.HttpClient Factory
+/// Routes every external identity provider's backchannel through Microsoft.Extensions.Http's client factory, so the
+/// named-client configuration (See ConfigureHttpClientFactoryForExternalIdentityProviders) and everything
+/// ConfigureHttpClientDefaults applies - resilience, service discovery, the SocketsHttpHandler settings - reach it.
+/// <para>
+/// OpenIdConnect and Apple are configured through <see cref="IConfigureNamedOptions{TOptions}"/> rather than
+/// <see cref="IPostConfigureOptions{TOptions}"/> on purpose. Their own framework post-configure builds a
+/// ConfigurationManager around whatever <c>Backchannel</c> it finds and keeps that instance for the process lifetime,
+/// so it has to already be the factory's client by then; assigning it afterwards leaves the discovery-document and
+/// JWKS fetches on a bare HttpClient while only the token/userinfo calls get the configured one. The OAuth-family
+/// handlers capture nothing, so they stay on post-configure.
+/// </para>
 /// </summary>
 public class RemoteAuthenticationOptionsConfigurator(IHttpClientFactory httpClientFactory)
-    : IPostConfigureOptions<OpenIdConnectOptions>,
+    : IConfigureNamedOptions<OpenIdConnectOptions>,
+        IConfigureNamedOptions<AppleAuthenticationOptions>,
         IPostConfigureOptions<GitHubAuthenticationOptions>,
         IPostConfigureOptions<TwitterOptions>,
         IPostConfigureOptions<FacebookOptions>,
         IPostConfigureOptions<MicrosoftIdentityOptions>,
-        IPostConfigureOptions<AppleAuthenticationOptions>,
         IPostConfigureOptions<GoogleOptions>
 {
     public void PostConfigure(string? name, RemoteAuthenticationOptions options)
@@ -26,32 +36,42 @@ public void PostConfigure(string? name, RemoteAuthenticationOptions options)
         options.Backchannel = httpClientFactory.CreateClient(name!);
     }
 
-    public void PostConfigure(string? name, OpenIdConnectOptions options)
+    public void Configure(string? name, OpenIdConnectOptions options)
     {
         PostConfigure(name, (RemoteAuthenticationOptions)options);
     }
 
-    public void PostConfigure(string? name, GitHubAuthenticationOptions options)
+    public void Configure(OpenIdConnectOptions options)
+    {
+        Configure(Options.DefaultName, options);
+    }
+
+    public void Configure(string? name, AppleAuthenticationOptions options)
     {
         PostConfigure(name, (RemoteAuthenticationOptions)options);
     }
 
-    public void PostConfigure(string? name, TwitterOptions options)
+    public void Configure(AppleAuthenticationOptions options)
+    {
+        Configure(Options.DefaultName, options);
+    }
+
+    public void PostConfigure(string? name, GitHubAuthenticationOptions options)
     {
         PostConfigure(name, (RemoteAuthenticationOptions)options);
     }
 
-    public void PostConfigure(string? name, FacebookOptions options)
+    public void PostConfigure(string? name, TwitterOptions options)
     {
         PostConfigure(name, (RemoteAuthenticationOptions)options);
     }
 
-    public void PostConfigure(string? name, MicrosoftIdentityOptions options)
+    public void PostConfigure(string? name, FacebookOptions options)
     {
         PostConfigure(name, (RemoteAuthenticationOptions)options);
     }
 
-    public void PostConfigure(string? name, AppleAuthenticationOptions options)
+    public void PostConfigure(string? name, MicrosoftIdentityOptions options)
     {
         PostConfigure(name, (RemoteAuthenticationOptions)options);
     }
@@ -96,6 +116,9 @@ public void ConfigureHttpClientFactoryForExternalIdentityProviders()
 
             });
 
+            // Program.Services.cs also registers a "Keycloak" client (with its BaseAddress, which
+            // AppUserClaimsPrincipalFactory's relative POST depends on). AddHttpClient accumulates rather than
+            // replaces, so both configure actions run; this one exists so the scheme always has a named client.
             services.AddHttpClient("Keycloak", httpClient =>
             {
 
@@ -109,11 +132,14 @@ public void ConfigureHttpClientFactoryForExternalIdentityProviders()
             services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<GoogleOptions>, RemoteAuthenticationOptionsConfigurator>());
             services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<TwitterOptions>, RemoteAuthenticationOptionsConfigurator>());
             services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<FacebookOptions>, RemoteAuthenticationOptionsConfigurator>());
-            services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<OpenIdConnectOptions>, RemoteAuthenticationOptionsConfigurator>());
             services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<MicrosoftIdentityOptions>, RemoteAuthenticationOptionsConfigurator>());
-            services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<AppleAuthenticationOptions>, RemoteAuthenticationOptionsConfigurator>());
             services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<GitHubAuthenticationOptions>, RemoteAuthenticationOptionsConfigurator>());
 
+            // Configure, not PostConfigure - see the note on RemoteAuthenticationOptionsConfigurator. The framework's
+            // own post-configure for these two captures Backchannel into a ConfigurationManager it keeps forever, so
+            // ours has to run first or the metadata/JWKS channel never sees the factory's client.
+            services.TryAddEnumerable(ServiceDescriptor.Singleton<IConfigureOptions<OpenIdConnectOptions>, RemoteAuthenticationOptionsConfigurator>());
+            services.TryAddEnumerable(ServiceDescriptor.Singleton<IConfigureOptions<AppleAuthenticationOptions>, RemoteAuthenticationOptionsConfigurator>());
         }
     }
 }
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Infrastructure/Services/PhoneService.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Infrastructure/Services/PhoneService.cs
index 53c82bdb59..e366604cda 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Infrastructure/Services/PhoneService.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Infrastructure/Services/PhoneService.cs
@@ -5,6 +5,7 @@ namespace Boilerplate.Server.Api.Infrastructure.Services;
 public partial class PhoneService
 {
     [AutoInject] private readonly ServerApiSettings appSettings = default!;
+    [AutoInject] private readonly IStringLocalizer<AppStrings> localizer = default!;
     [AutoInject] private readonly PhoneNumberUtil phoneNumberUtil = default!;
     [AutoInject] private readonly IHostEnvironment hostEnvironment = default!;
     [AutoInject] private readonly ILogger<PhoneService> phoneLogger = default!;
@@ -21,9 +22,23 @@ public partial class PhoneService
                          ? value.ToString()
                          : new RegionInfo((CultureInfoManager.InvariantGlobalization is false ? CultureInfo.CurrentUICulture : CultureInfoManager.DefaultCulture).Name).TwoLetterISORegionName;
 
-        var parsedPhoneNumber = phoneNumberUtil.Parse(phoneNumber, region);
+        try
+        {
+            var parsedPhoneNumber = phoneNumberUtil.Parse(phoneNumber, region);
 
-        return phoneNumberUtil.Format(parsedPhoneNumber, PhoneNumberFormat.E164);
+            return phoneNumberUtil.Format(parsedPhoneNumber, PhoneNumberFormat.E164);
+        }
+        catch (NumberParseException exp)
+        {
+            // libphonenumber is far stricter than the [Phone] data annotation the DTOs carry, so a value that passed
+            // model validation can still land here - "+1" does. The region is caller-influenced too: Cloudflare sends
+            // XX for unknown geography and T1 for Tor, and neither is a region libphonenumber accepts, which makes any
+            // national-format number throw for a perfectly legitimate visitor. Unhandled this surfaces as a 500 logged
+            // at Critical on an anonymous endpoint; it is a bad request.
+            throw new BadRequestException(localizer[nameof(AppStrings.PhoneAttribute_ValidationError), localizer[nameof(AppStrings.PhoneNumber)]])
+                .WithData("Reason", exp.Message)
+                .WithData("Region", region);
+        }
     }
 
     public virtual async Task SendSms(string messageText, string phoneNumber)
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Shared/Infrastructure/Extensions/UriExtensions.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Shared/Infrastructure/Extensions/UriExtensions.cs
index 5611100894..ea75b352b7 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Shared/Infrastructure/Extensions/UriExtensions.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Shared/Infrastructure/Extensions/UriExtensions.cs
@@ -4,28 +4,6 @@ namespace System;
 
 public static partial class UriExtensions
 {
-    extension(Uri)
-    {
-        /// <summary>
-        /// True only for an app-rooted relative url such as <c>/sign-in?otp=123</c>.
-        /// <br/>
-        /// <see cref="Uri.IsWellFormedUriString"/> with <see cref="UriKind.Relative"/> is NOT enough on its own:
-        /// a network-path reference like <c>//attacker.com/path</c> is a well-formed RELATIVE reference, and both
-        /// browsers and <c>NavigationManager.NavigateTo</c> resolve it to <c>https://attacker.com/path</c>.
-        /// Browsers treat <c>/\host</c> the same way, so the second character is rejected too.
-        /// <br/>
-        /// Use this wherever a url arrives from outside the app and is then navigated to - the Blazor Hybrid local
-        /// HTTP server's external-sign-in callback and the sign-in / sign-up pages that consume it.
-        /// </summary>
-        public static bool IsAppRelativeUrl([NotNullWhen(true)] string? url)
-        {
-            return string.IsNullOrEmpty(url) is false
-                   && url.StartsWith('/')
-                   && (url.Length is 1 || url[1] is not ('/' or '\\'))
-                   && Uri.IsWellFormedUriString(url, UriKind.Relative);
-        }
-    }
-
     extension(Uri uri)
     {
         public string GetUrlWithoutQueryParameter(string key)
@@ -96,5 +74,43 @@ public string GetPath()
             var uriBuilder = new UriBuilder(uri.GetUrlWithoutCulture()) { Query = string.Empty, Fragment = string.Empty };
             return uriBuilder.Path;
         }
+
+        /// <summary>
+        /// True only for a relative url that cannot leave this app's origin, such as <c>/sign-in?otp=123</c>.
+        /// <br/>
+        /// <see cref="Uri.IsWellFormedUriString"/> with <see cref="UriKind.Relative"/> is NOT enough on its own:
+        /// a network-path reference like <c>//attacker.com/path</c> is a well-formed RELATIVE reference, and both
+        /// browsers and <c>NavigationManager.NavigateTo</c> resolve it to <c>https://attacker.com/path</c>.
+        /// Browsers treat <c>/\host</c> and a leading backslash the same way, so those are rejected too.
+        /// <br/>
+        /// Use this wherever a url arrives from outside the app and is then navigated to - the Blazor Hybrid local
+        /// HTTP server's external-sign-in callback, and every <c>return-url</c> that reaches
+        /// <c>NavigationManager.NavigateTo</c>.
+        /// </summary>
+        /// <param name="requireLeadingSlash">
+        /// Keep the default when the url is expected to be app-rooted (<c>/products/1</c>). Pass <c>false</c> for a
+        /// <c>return-url</c>, because the app itself produces base-relative values without the leading slash - see
+        /// <c>NavigationManagerExtensions.GetRelativePath</c>, which <c>AppShell</c> and <c>SignInModalService</c>
+        /// feed straight into a <c>return-url</c>. Rootless values are equally origin-bound: a well-formed relative
+        /// reference carries no scheme and no authority, so it always resolves against the app's own base.
+        /// </param>
+        public static bool IsAppRelativeUrl([NotNullWhen(true)] string? url, bool requireLeadingSlash = true)
+        {
+            if (string.IsNullOrEmpty(url))
+                return false;
+
+            if (url[0] is '\\')
+                return false;
+
+            if (url[0] is '/')
+            {
+                if (url.Length > 1 && url[1] is '/' or '\\')
+                    return false;
+            }
+            else if (requireLeadingSlash)
+                return false;
+
+            return Uri.IsWellFormedUriString(url, UriKind.Relative);
+        }
     }
 }
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/BunitUITests.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/BunitUITests.cs
index cec257cbde..50189ea243 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/BunitUITests.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/BunitUITests.cs
@@ -52,9 +52,9 @@ public async Task SignIn_Should_WorkAsExpected()
         // user is the seeded default account.
         var authenticationStateProvider = ctx.Services.GetRequiredService<AuthenticationStateProvider>();
 
-        cut.WaitForAssertion(() =>
+        await cut.WaitForAssertionAsync(async () =>
         {
-            var user = authenticationStateProvider.GetAuthenticationStateAsync().GetAwaiter().GetResult().User;
+            var user = (await authenticationStateProvider.GetAuthenticationStateAsync()).User;
             Assert.IsTrue(user.IsAuthenticated());
             Assert.AreEqual(Guid.Parse("8ff71671-a1d6-4f97-abb9-d87d7b47d6e7"), user.GetUserId());
         }, timeout: TimeSpan.FromSeconds(30));
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/ConfirmPageTwoFactorTests.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/ConfirmPageTwoFactorTests.cs
new file mode 100644
index 0000000000..c1f896e80f
--- /dev/null
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/ConfirmPageTwoFactorTests.cs
@@ -0,0 +1,105 @@
+using Bunit;
+using Microsoft.EntityFrameworkCore;
+using Boilerplate.Shared.Features.Identity;
+using Boilerplate.Server.Api.Infrastructure.Data;
+using Boilerplate.Tests.Infrastructure.Services;
+using Boilerplate.Server.Api.Features.Identity.Models;
+using Microsoft.AspNetCore.Components.Authorization;
+using Boilerplate.Client.Core.Components.Pages.Identity;
+using Boilerplate.Client.Core.Infrastructure.Services.Contracts;
+
+namespace Boilerplate.Tests.Features.Identity;
+
+/// <summary>
+/// Confirming an identifier ends with an automatic sign-in, and that sign-in answers
+/// <c>{ requiresTwoFactor: true }</c> - HTTP 200, with <b>null</b> tokens and no session row - whenever the account has
+/// two-factor enabled. <c>ConfirmEmailRequestDto</c> carries no second-factor code, so the flow cannot be completed
+/// from this page at all; the only correct behaviour is to confirm and stop.
+/// <para>
+/// Storing that response instead is the failure this pins, and it is worse than it looks: on the Web client the null
+/// crosses JS interop and <c>Storage.setItem</c> coerces it, so <c>access_token</c> becomes the literal string
+/// <c>"null"</c>, which is non-empty enough to pass the token provider's guard and then throws while being parsed - an
+/// interrupting error dialog on every auth-state evaluation until the tokens are cleared, on top of the sign-out.
+/// </para>
+/// </summary>
+[TestClass, TestCategory("UITest")]
+public class ConfirmPageTwoFactorTests
+{
+    [TestMethod]
+    public async Task ConfirmEmail_Should_NotStoreTokens_When_TheAccountRequiresASecondFactor()
+    {
+        await using var server = new AppTestServer();
+        await server.Build().Start(TestContext.CancellationToken);
+
+        var (email, token) = await CreateUnconfirmedTwoFactorAccount(server);
+
+        await using var ctx = server.CreateBunitContext();
+
+        var storageService = ctx.Services.GetRequiredService<IStorageService>();
+        await storageService.SetItem("access_token", ExistingSessionMarker);
+
+        // [SupplyParameterFromQuery] values cannot be passed as bUnit parameters - the query string has to be real, so
+        // navigate to the confirmation link first. That is also exactly what clicking the e-mailed link does, and
+        // ConfirmPage.OnInitAsync then auto-submits ConfirmEmail.
+        var navigationManager = ctx.Services.GetRequiredService<NavigationManager>();
+        var confirmUrl = $"{PageUrls.Confirm}?email={Uri.EscapeDataString(email)}&emailToken={Uri.EscapeDataString(token)}";
+        navigationManager.NavigateTo(confirmUrl);
+
+        var cut = ctx.Render<CascadingAuthenticationState>(parameters => parameters.AddChildContent<ConfirmPage>());
+
+        // The confirmation itself must still happen - this is not "reject the request", it is "do not pretend it
+        // signed you in".
+        await cut.WaitForAssertionAsync(async () =>
+        {
+            Assert.IsTrue(await IsEmailConfirmed(server, email), "The e-mail must still be confirmed.");
+        }, timeout: TimeSpan.FromSeconds(30));
+
+        Assert.AreEqual(ExistingSessionMarker, await storageService.GetItem("access_token"),
+            "A requiresTwoFactor response carries null tokens; storing it would overwrite the caller's live session.");
+
+        Assert.AreEqual(navigationManager.ToAbsoluteUri(confirmUrl).ToString(), navigationManager.Uri,
+            "Without tokens the user is not signed in, so the page must not navigate away as if it had succeeded.");
+    }
+
+    /// <summary>
+    /// Creates an account whose e-mail is still unconfirmed while two-factor authentication is on, and returns the
+    /// confirmation code that was e-mailed to it. <c>TwoFactorEnabled</c> is set directly on the row because the
+    /// shipped flow for turning it on (<c>UserController</c>) needs an authenticator app.
+    /// </summary>
+    private async Task<(string email, string token)> CreateUnconfirmedTwoFactorAccount(AppTestServer server)
+    {
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var identityController = scope.ServiceProvider.GetRequiredService<IIdentityController>();
+
+        var email = MagicLinkSignInUtils.NewTestEmail();
+
+        // A brand-new address auto-provisions an unconfirmed account and mails it a confirmation code.
+        await Assert.ThrowsExactlyAsync<BadRequestException>(
+            () => identityController.SendOtp(new() { Email = email }, null, TestContext.CancellationToken));
+
+        var captured = await server.WaitForCapturedEmail(email, e => e.Kind is CapturedEmailKind.EmailToken, TestContext.CancellationToken);
+
+        await using var dbScope = server.WebApp.Services.CreateAsyncScope();
+        var dbContext = dbScope.ServiceProvider.GetRequiredService<AppDbContext>();
+        var normalizedEmail = email.ToUpperInvariant();
+        await dbContext.Set<User>()
+            .Where(u => u.NormalizedEmail == normalizedEmail)
+            .ExecuteUpdateAsync(setters => setters.SetProperty(u => u.TwoFactorEnabled, true), TestContext.CancellationToken);
+
+        return (email, captured.Token!);
+    }
+
+    private static async Task<bool> IsEmailConfirmed(AppTestServer server, string email)
+    {
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var dbContext = scope.ServiceProvider.GetRequiredService<AppDbContext>();
+        var normalizedEmail = email.ToUpperInvariant();
+
+        return await dbContext.Set<User>().AnyAsync(u => u.NormalizedEmail == normalizedEmail && u.EmailConfirmed);
+    }
+
+    /// <summary>A recognisable stand-in for the token of a session that already exists in this browser.</summary>
+    private const string ExistingSessionMarker = "existing-session-access-token";
+
+    public Microsoft.VisualStudio.TestTools.UnitTesting.TestContext TestContext { get; set; } = default!;
+}
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/OneTimeTokenTests.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/OneTimeTokenTests.cs
new file mode 100644
index 0000000000..5e21ebf77f
--- /dev/null
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/OneTimeTokenTests.cs
@@ -0,0 +1,162 @@
+using Microsoft.EntityFrameworkCore;
+using Boilerplate.Shared.Features.Identity;
+using Boilerplate.Server.Api.Infrastructure.Data;
+using Boilerplate.Tests.Infrastructure.Services;
+using Boilerplate.Server.Api.Features.Identity.Models;
+
+namespace Boilerplate.Tests.Features.Identity;
+
+/// <summary>
+/// The one-time token flows (e-mail / phone confirmation and password reset) share one shape: a nullable
+/// <c>*TokenRequestedOn</c> column, an expiry gate that subtracts it from now, and a token whose <b>purpose string</b>
+/// embeds that same timestamp. Two things about that shape fail quietly, and both are pinned here.
+/// <para>
+/// 1. <b>The expiry gate is a lifted comparison.</b> <c>DateTimeOffset - DateTimeOffset?</c> is <c>TimeSpan?</c>, and a
+/// lifted <c>&gt;</c> is <c>false</c> when the column is null - which is exactly the state a <i>consumed</i> token
+/// leaves behind. Without an explicit null check the gate is skipped and the request runs on into a verification that
+/// can never succeed, charging the user an <c>AccessFailedAsync</c> strike on the way.
+/// </para>
+/// <para>
+/// 2. <b>The purpose string must be built from the same value on both sides.</b> The account lookup is
+/// case-insensitive (it matches on <c>NormalizedEmail</c>) but the purpose is an HMAC input, so verifying against the
+/// caller's casing while minting from the stored casing rejects the user's own valid code.
+/// </para>
+/// Neither failure is visible from the code alone - both look like an ordinary "Invalid token." - which is why they
+/// are worth the cost of a test.
+/// </summary>
+[TestClass, TestCategory("IntegrationTest")]
+public class OneTimeTokenTests
+{
+    /// <summary>
+    /// Re-opening a confirmation link that was already used. <c>ConfirmEmail</c> nulls <c>EmailTokenRequestedOn</c> on
+    /// success, and <c>ConfirmPage</c> auto-submits whenever the link carries an <c>emailToken</c>, so a second device,
+    /// a second tab or a reload replays it. The replay must be rejected as expired <b>without</b> touching the
+    /// account's failed-access count: that count does not decay, so five such replays over an account's life would
+    /// lock the user out of password sign-in for something they did not do.
+    /// </summary>
+    [TestMethod]
+    public async Task ReplayingAConsumedConfirmationToken_Should_NotChargeAFailedAccessAttempt()
+    {
+        await using var server = new AppTestServer();
+        await server.Build(services => services.AddIntegrationApiOnlyTestsServices()).Start(TestContext.CancellationToken);
+
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var identityController = scope.ServiceProvider.GetRequiredService<IIdentityController>();
+
+        var email = MagicLinkSignInUtils.NewTestEmail();
+
+        await Assert.ThrowsExactlyAsync<BadRequestException>(
+            () => identityController.SendOtp(new() { Email = email }, null, TestContext.CancellationToken));
+
+        var captured = await server.WaitForCapturedEmail(email, e => e.Kind is CapturedEmailKind.EmailToken, TestContext.CancellationToken);
+
+        // First use succeeds and clears EmailTokenRequestedOn.
+        await identityController.ConfirmEmail(new() { Email = email, Token = captured.Token }, TestContext.CancellationToken);
+
+        var failedCountBeforeReplay = await ReadAccessFailedCount(server, email);
+
+        var replay = await Assert.ThrowsExactlyAsync<BadRequestException>(
+            () => identityController.ConfirmEmail(new() { Email = email, Token = captured.Token }, TestContext.CancellationToken),
+            "Replaying a consumed confirmation token must be rejected.");
+
+        Assert.AreEqual(nameof(AppStrings.ExpiredToken), replay.Key,
+            "A consumed token has no outstanding request, so the expiry gate must reject it before the token check - " +
+            "reporting InvalidToken instead means the lifted null comparison let it through.");
+
+        Assert.AreEqual(failedCountBeforeReplay, await ReadAccessFailedCount(server, email),
+            "Rejecting a provably unverifiable replay must not spend the user's lockout budget.");
+    }
+
+    /// <summary>
+    /// The same gate on the phone flow, which the shipped seed data reaches directly: <c>UserConfiguration</c> seeds
+    /// <c>PhoneNumberConfirmed = true</c> while leaving <c>PhoneNumberTokenRequestedOn</c> null.
+    /// </summary>
+    [TestMethod]
+    public async Task ConfirmingAPhoneWithNoOutstandingToken_Should_ReportExpiredRatherThanInvalid()
+    {
+        await using var server = new AppTestServer();
+        await server.Build(services => services.AddIntegrationApiOnlyTestsServices()).Start(TestContext.CancellationToken);
+
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var identityController = scope.ServiceProvider.GetRequiredService<IIdentityController>();
+
+        var exception = await Assert.ThrowsExactlyAsync<BadRequestException>(
+            () => identityController.ConfirmPhone(new() { PhoneNumber = SeededTestPhoneNumber, Token = "123456" }, TestContext.CancellationToken),
+            "There is no outstanding phone token for the seeded account, so this must not be accepted.");
+
+        Assert.AreEqual(nameof(AppStrings.ExpiredToken), exception.Key,
+            "PhoneNumberTokenRequestedOn is null for the seeded account, so the expiry gate must fire first.");
+    }
+
+    /// <summary>
+    /// A user who registered as <c>John.Doe@Example.com</c> and later types <c>john.doe@example.com</c> resolves to the
+    /// same account, because Identity looks accounts up by <c>NormalizedEmail</c>. The 6-digit code they were sent must
+    /// therefore still work - it is minted from the stored address, so verifying against the typed one would reject a
+    /// correctly delivered code and charge a strike for it.
+    /// </summary>
+    [TestMethod]
+    public async Task ConfirmEmail_Should_AcceptACaseVariantOfTheRegisteredAddress()
+    {
+        await using var server = new AppTestServer();
+        await server.Build(services => services.AddIntegrationApiOnlyTestsServices()).Start(TestContext.CancellationToken);
+
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var identityController = scope.ServiceProvider.GetRequiredService<IIdentityController>();
+
+        var email = $"Mixed.Case.{Guid.NewGuid()}@BitPlatform.dev";
+
+        await Assert.ThrowsExactlyAsync<BadRequestException>(
+            () => identityController.SendOtp(new() { Email = email }, null, TestContext.CancellationToken));
+
+        var captured = await server.WaitForCapturedEmail(email, e => e.Kind is CapturedEmailKind.EmailToken, TestContext.CancellationToken);
+
+        // The user types their address in a different case than they registered with.
+        await identityController.ConfirmEmail(
+            new() { Email = email.ToLowerInvariant(), Token = captured.Token }, TestContext.CancellationToken);
+
+        await using var dbScope = server.WebApp.Services.CreateAsyncScope();
+        var dbContext = dbScope.ServiceProvider.GetRequiredService<AppDbContext>();
+        var normalizedEmail = email.ToUpperInvariant();
+
+        Assert.IsTrue(await dbContext.Set<User>().AnyAsync(u => u.NormalizedEmail == normalizedEmail && u.EmailConfirmed, TestContext.CancellationToken),
+            "The code was correct and was delivered to that address, so a difference in casing must not reject it.");
+    }
+
+    /// <summary>
+    /// <c>[Phone]</c> (the only validation the DTOs carry) is far more permissive than libphonenumber, which is what
+    /// actually parses the value: <c>"+1"</c> passes the attribute and throws inside <c>PhoneService</c>. On an
+    /// anonymous endpoint that difference is the difference between a 400 and a 500 logged at Critical.
+    /// </summary>
+    [TestMethod]
+    [DataRow("+1")]
+    [DataRow("+999999999999999999")]
+    public async Task AnUnparsablePhoneNumber_Should_BeABadRequestRatherThanAServerFault(string phoneNumber)
+    {
+        await using var server = new AppTestServer();
+        await server.Build(services => services.AddIntegrationApiOnlyTestsServices()).Start(TestContext.CancellationToken);
+
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var identityController = scope.ServiceProvider.GetRequiredService<IIdentityController>();
+
+        await Assert.ThrowsExactlyAsync<BadRequestException>(
+            () => identityController.SendConfirmPhoneToken(new() { PhoneNumber = phoneNumber }, TestContext.CancellationToken),
+            $"'{phoneNumber}' passes the [Phone] attribute but libphonenumber cannot parse it; that is a bad request, not a server fault.");
+    }
+
+    /// <summary>The phone number <c>UserConfiguration</c> seeds for the default test account.</summary>
+    private const string SeededTestPhoneNumber = "+31684207362";
+
+    private static async Task<int> ReadAccessFailedCount(AppTestServer server, string email)
+    {
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var dbContext = scope.ServiceProvider.GetRequiredService<AppDbContext>();
+        var normalizedEmail = email.ToUpperInvariant();
+
+        return await dbContext.Set<User>()
+            .Where(u => u.NormalizedEmail == normalizedEmail)
+            .Select(u => u.AccessFailedCount)
+            .SingleAsync();
+    }
+
+    public TestContext TestContext { get; set; } = default!;
+}
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/PhoneNumberNormalizationUITests.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/PhoneNumberNormalizationUITests.cs
index f0126053fa..bf159cbb85 100644
--- a/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/PhoneNumberNormalizationUITests.cs
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/PhoneNumberNormalizationUITests.cs
@@ -68,7 +68,7 @@ await server.Build(services =>
         // proves the number was normalized (not merely passed through).
         var e164 = new Regex(@"^\+[1-9]\d{6,14}$");
 
-        foreach (var attempt in attempts)
+        foreach (var (Typed, Normalized) in attempts)
         {
             // Each request starts from a fresh Sign in page. A hard reload is the simplest way back to the phone form:
             // the OTP panel is treated as a modal, but its NavigationLock only intercepts internal Blazor navigation
@@ -82,17 +82,17 @@ await Page.GotoAsync(new Uri(serverAddress, PageUrls.SignIn).ToString(),
             // Type the de-normalized number into the BitPhoneInput's number box (its <input type="tel"> carries the
             // placeholder) and ask for the code. Send OTP stays disabled until the debounced value commits, so
             // Playwright's actionability wait covers the 500ms debounce.
-            await Page.GetByPlaceholder(AppStrings.PhoneNumberPlaceholder).FillAsync(attempt.Typed);
+            await Page.GetByPlaceholder(AppStrings.PhoneNumberPlaceholder).FillAsync(Typed);
             await Page.GetByRole(AriaRole.Button, new() { Name = AppStrings.SendOtpButtonText }).ClickAsync();
 
             // The server registers the new account, texts the confirmation code (captured synchronously by the fake) and
             // answers "not confirmed", which reveals the OTP panel - a reliable signal that SendSms has already run.
             await Page.Locator(".bit-otp-inp").First.WaitForAsync();
 
-            var sms = await WaitForSmsTo(attempt.Normalized, TestContext.CancellationToken);
+            var sms = await WaitForSmsTo(Normalized, TestContext.CancellationToken);
 
-            Assert.AreEqual(attempt.Normalized, sms.PhoneNumber,
-                $"The server should have normalized '{attempt.Typed}' to E.164 before calling SendSms.");
+            Assert.AreEqual(Normalized, sms.PhoneNumber,
+                $"The server should have normalized '{Typed}' to E.164 before calling SendSms.");
             Assert.MatchesRegex(e164, sms.PhoneNumber,
                 "SendSms must receive a canonical E.164 number (leading '+', digits only, no formatting).");
         }
@@ -146,8 +146,8 @@ await Page.GotoAsync(new Uri(serverAddress, PageUrls.SignIn).ToString(),
 /// is exactly what the server normalized - which is the behavior under test. Registered per-test via
 /// <c>configureTestServices</c> (RemoveAll&lt;PhoneService&gt; then AddScoped&lt;PhoneService, CapturingPhoneService&gt;).
 /// </summary>
-public partial class CapturingPhoneService(ServerApiSettings appSettings, IBackgroundJobClient backgroundJobClient, IHostEnvironment hostEnvironment, IHttpContextAccessor httpContextAccessor, ILogger<PhoneService> phoneLogger, PhoneNumberUtil phoneNumberUtil) :
-    PhoneService(appSettings, backgroundJobClient, hostEnvironment, httpContextAccessor, phoneLogger, phoneNumberUtil)
+public partial class CapturingPhoneService(ServerApiSettings appSettings, IBackgroundJobClient backgroundJobClient, IHostEnvironment hostEnvironment, IHttpContextAccessor httpContextAccessor, IStringLocalizer<AppStrings> localizer, ILogger<PhoneService> phoneLogger, PhoneNumberUtil phoneNumberUtil) :
+    PhoneService(appSettings, backgroundJobClient, hostEnvironment, httpContextAccessor, localizer, phoneLogger, phoneNumberUtil)
 {
     /// <summary>
     /// Every SendSms call as (message body, phone number). Static because DI owns the resolved instance's lifetime, so a
diff --git a/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/ReturnUrlHardeningTests.cs b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/ReturnUrlHardeningTests.cs
new file mode 100644
index 0000000000..ad1cd48b41
--- /dev/null
+++ b/src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/ReturnUrlHardeningTests.cs
@@ -0,0 +1,170 @@
+using System.Web;
+using Boilerplate.Shared.Features.Identity;
+using Boilerplate.Tests.Infrastructure.Services;
+
+namespace Boilerplate.Tests.Features.Identity;
+
+/// <summary>
+/// Guards the <c>return-url</c> trust boundary. The value travels a long way from an anonymous request body, through
+/// a link the app itself e-mails, into <c>NavigationManager.NavigateTo</c> on the client - so anything that can leave
+/// this origin has to be rejected somewhere, and <see cref="Uri.IsAppRelativeUrl"/> is that somewhere.
+/// <para>
+/// The predicate has two subtleties worth pinning: a network-path reference such as <c>//attacker.com</c> is a
+/// perfectly <b>well-formed relative</b> reference that browsers resolve off-origin, and the app itself produces
+/// base-relative return urls <b>without</b> a leading slash (See <c>NavigationManagerExtensions.GetRelativePath</c>,
+/// which <c>AppShell</c> feeds straight into a <c>return-url</c>), so a rooted-only predicate would break the app's
+/// own sign-in links.
+/// </para>
+/// </summary>
+[TestClass, TestCategory("UnitTest")]
+public class ReturnUrlPredicateTests
+{
+    /// <summary>
+    /// Values the app itself generates, plus the rooted form the e-mailed links carry. All must survive.
+    /// </summary>
+    [TestMethod]
+    [DataRow("/")]
+    [DataRow("/products/1")]
+    [DataRow("/sign-in?otp=123456")]
+    [DataRow("/confirm?email=a%40b.c&emailToken=123456")]
+    // GetRelativePath() returns a BASE-relative path, i.e. no leading slash - this is what AppShell and
+    // SignInModalService put into a return-url, so rejecting it would break ordinary sign-in.
+    [DataRow("products/1")]
+    [DataRow("sign-in")]
+    [DataRow("products/1?a=b")]
+    public void IsAppRelativeUrl_Should_AcceptTheUrlsTheAppItselfProduces(string url)
+    {
+        Assert.IsTrue(Uri.IsAppRelativeUrl(url, requireLeadingSlash: false),
+            $"'{url}' is produced by the app itself and must not be rejected.");
+    }
+
+    /// <summary>
+    /// Everything that can leave the origin. The <c>//</c> and <c>/\</c> forms are the interesting ones: both are
+    /// well-formed RELATIVE references, so <c>Uri.IsWellFormedUriString(_, UriKind.Relative)</c> alone would let them
+    /// through and the browser would then resolve them to the attacker's host.
+    /// </summary>
+    [TestMethod]
+    [DataRow("//evil.example")]
+    [DataRow("//evil.example/path")]
+    [DataRow("///evil.example")]
+    [DataRow("/\\evil.example")]
+    [DataRow("\\\\evil.example")]
+    [DataRow("\\/evil.example")]
+    [DataRow("https://evil.example")]
+    [DataRow("http://evil.example/x")]
+    [DataRow("app://localhost/x")]
+    [DataRow("javascript:alert(1)")]
+    [DataRow("")]
+    public void IsAppRelativeUrl_Should_RejectAnythingThatCanLeaveTheOrigin(string url)
+    {
+        Assert.IsFalse(Uri.IsAppRelativeUrl(url, requireLeadingSlash: false),
+            $"'{url}' can escape this app's origin and must be rejected.");
+        Assert.IsFalse(Uri.IsAppRelativeUrl(url),
+            $"'{url}' must also be rejected by the stricter, rooted-only form.");
+    }
+
+    /// <summary>
+    /// The default (rooted-only) form is what the Blazor Hybrid local HTTP server's callback uses, and it must stay
+    /// strict: a rootless value is origin-bound but is not a valid app-rooted url.
+    /// </summary>
+    [TestMethod]
+    public void IsAppRelativeUrl_Should_StillRequireALeadingSlashByDefault()
+    {
+        Assert.IsFalse(Uri.IsAppRelativeUrl("products/1"), "The default overload must keep requiring a leading slash.");
+        Assert.IsTrue(Uri.IsAppRelativeUrl("/products/1"), "A rooted url must pass the default overload.");
+    }
+}
+
+/// <summary>
+/// The server half of the same boundary: <c>returnUrl</c> arrives in an <b>anonymous</b> request body and is spliced
+/// into a link the application e-mails from its own domain, so an off-origin value would turn the app's own
+/// transactional mail into a redirector. These tests read the captured e-mail (See <see cref="TestIdentityEmailService"/>)
+/// and assert what actually left the building.
+/// </summary>
+[TestClass, TestCategory("IntegrationTest")]
+public class ReturnUrlHardeningTests
+{
+    /// <summary>
+    /// <c>SendOtp</c> needs no pre-existing account - it auto-provisions - so this is reachable by an anonymous caller
+    /// against any address they choose, which is what makes it worth a test rather than a comment.
+    /// </summary>
+    [TestMethod]
+    public async Task SendOtp_Should_NotPutAnOffOriginReturnUrlIntoTheConfirmationEmail()
+    {
+        await using var server = new AppTestServer();
+        await server.Build(services => services.AddIntegrationApiOnlyTestsServices()).Start(TestContext.CancellationToken);
+
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var identityController = scope.ServiceProvider.GetRequiredService<IIdentityController>();
+
+        var email = MagicLinkSignInUtils.NewTestEmail();
+
+        // A brand-new address: the account is created unconfirmed, so SendOtp sends the CONFIRMATION mail, and the
+        // attacker-chosen returnUrl is what would be embedded in its link.
+        await Assert.ThrowsExactlyAsync<BadRequestException>(
+            () => identityController.SendOtp(new() { Email = email, ReturnUrl = "https://evil.example/login" }, null, TestContext.CancellationToken),
+            "A brand-new account is unconfirmed, so SendOtp must answer UserIsNotConfirmed after mailing the confirmation link.");
+
+        var captured = await server.WaitForCapturedEmail(email, e => e.Kind is CapturedEmailKind.EmailToken, TestContext.CancellationToken);
+
+        var returnUrl = HttpUtility.ParseQueryString(captured.Link!.Query)["return-url"];
+
+        Assert.AreEqual(PageUrls.Home, returnUrl,
+            $"An off-origin return url must be replaced by the home page, but the e-mailed link carried '{returnUrl}'.");
+    }
+
+    /// <summary>
+    /// The same boundary on the reset-password flow, which takes its return url from a different DTO and builds its
+    /// link in a different method - so it can (and did) regress independently. A network-path reference is the
+    /// interesting payload here: it is a well-formed RELATIVE url, so it slips past the obvious check.
+    /// </summary>
+    [TestMethod]
+    [DataRow("//evil.example/login", PageUrls.Home, "A network-path reference is a well-formed RELATIVE url, so it must be caught explicitly.")]
+    [DataRow("https://evil.example/login", PageUrls.Home, "An absolute url must never survive into an e-mailed link.")]
+    // The guard must not become "replace everything": an ordinary in-app return url has to survive end to end, or
+    // resetting a password from a product page would drop the user on the home page instead of bringing them back.
+    [DataRow("/settings/sessions", "/settings/sessions", "A legitimate app-relative return url must be preserved.")]
+    public async Task SendResetPasswordToken_Should_OnlyEmailAnAppRelativeReturnUrl(string requested, string expected, string because)
+    {
+        await using var server = new AppTestServer();
+        await server.Build(services => services.AddIntegrationApiOnlyTestsServices()).Start(TestContext.CancellationToken);
+
+        await using var scope = server.WebApp.Services.CreateAsyncScope();
+        var identityController = scope.ServiceProvider.GetRequiredService<IIdentityController>();
+
+        // A per-run account, not the seeded one: SendResetPasswordToken is throttled per user for the token's whole
+        // lifetime, so sharing an account across these rows (they run in parallel) would fail on the resend delay.
+        var email = await CreateConfirmedAccount(server, identityController);
+
+        await identityController.SendResetPasswordToken(
+            new() { Email = email, ReturnUrl = requested }, TestContext.CancellationToken);
+
+        var captured = await server.WaitForCapturedEmail(email, e => e.Kind is CapturedEmailKind.ResetPassword, TestContext.CancellationToken);
+
+        var returnUrl = HttpUtility.ParseQueryString(captured.Link!.Query)["return-url"];
+
+        Assert.AreEqual(expected, returnUrl, $"{because} The e-mailed link carried '{returnUrl}'.");
+    }
+
+    /// <summary>
+    /// Registers and confirms a brand-new account, so the test owns its own fixture instead of mutating the seeded
+    /// one. <c>SendOtp</c> auto-provisions the (unconfirmed) account and mails the confirmation code; consuming that
+    /// code confirms it, which is what <c>SendResetPasswordToken</c> requires.
+    /// </summary>
+    private async Task<string> CreateConfirmedAccount(AppTestServer server, IIdentityController identityController)
+    {
+        var email = MagicLinkSignInUtils.NewTestEmail();
+
+        await Assert.ThrowsExactlyAsync<BadRequestException>(
+            () => identityController.SendOtp(new() { Email = email }, null, TestContext.CancellationToken),
+            "A brand-new account is unconfirmed, so SendOtp answers UserIsNotConfirmed after mailing the confirmation link.");
+
+        var captured = await server.WaitForCapturedEmail(email, e => e.Kind is CapturedEmailKind.EmailToken, TestContext.CancellationToken);
+
+        await identityController.ConfirmEmail(new() { Email = email, Token = captured.Token }, TestContext.CancellationToken);
+
+        return email;
+    }
+
+    public TestContext TestContext { get; set; } = default!;
+}