diff --git a/be/app/routers/auth.py b/be/app/routers/auth.py
index ffb7b2c..a1a1a46 100644
--- a/be/app/routers/auth.py
+++ b/be/app/routers/auth.py
@@ -3,6 +3,7 @@
 from fastapi.responses import RedirectResponse
 from authlib.integrations.starlette_client import OAuth
 from starlette.config import Config as AuthlibConfig
+from fastapi.responses import JSONResponse
 
 from app import config
 from app.models import TokenRequest
@@ -33,6 +34,10 @@ async def login(request: Request):
 
 @router.post("/api/auth/token")
 def get_token(request: Request, token_req: TokenRequest):
+    """
+    Exchanges the SSO code for an Access Token, sets the token in a secure 
+    HTTP-only cookie, and returns minimal user details.
+    """
     data = {
         "grant_type": "authorization_code",
         "code": token_req.code,
@@ -41,17 +46,70 @@ def get_token(request: Request, token_req: TokenRequest):
         "redirect_uri": config.REDIRECT_URI,
     }
     response = requests.post(config.TOKEN_URL, data=data)
+    
     if response.status_code != 200:
         raise HTTPException(status_code=400, detail="Failed to exchange code for token")
     
     token_data = response.json()
-    user_info_resp = requests.get(f"{config.OPENID_PROVIDER_URL}/userinfo",
-                                  headers={'Authorization': f'Bearer {token_data["access_token"]}'})
-    user_email = user_info_resp.json()['email']
-    request.session['user'] = user_email
-    return user_email
+    access_token = token_data["access_token"]
+    
+    user_info_resp = requests.get(
+        f"{config.OPENID_PROVIDER_URL}/userinfo",
+        headers={'Authorization': f'Bearer {access_token}'}
+    )
+    user_data = user_info_resp.json()
+    
+    user_return_data = {
+        "id": user_data.get('sub', user_data.get('email', 'unknown')), 
+        "email": user_data.get('email', 'unknown'),
+    }
+    
+    response_to_client = JSONResponse(content=user_return_data)
 
-@router.get("/api/logout")
+    request.session['user'] = user_data.get('email')
+    request.session['access_token'] = access_token
+
+    return response_to_client
+
+@router.get("/api/auth/session")
+def check_session(request: Request):
+    # 1. Get the token from the cookie sent by the browser
+    access_token = request.session.get("access_token")
+    
+    if not access_token:
+        # If no cookie exists, return 401 Unauthorized
+        raise HTTPException(status_code=401, detail="No session token found")
+
+    # 2. Use the token to get the user info/validate it against the SSO provider
+    # NOTE: Your BE may need to check the token's expiration itself before calling the SSO provider
+    user_info_resp = requests.get(
+        f"{config.OPENID_PROVIDER_URL}/userinfo",
+        headers={'Authorization': f'Bearer {access_token}'}
+    )
+
+    if user_info_resp.status_code != 200:
+        # If the SSO provider says the token is invalid/expired
+        raise HTTPException(status_code=401, detail="Token validation failed or expired")
+
+    # 3. Token is valid. Return the user data to the frontend.
+    user_data = user_info_resp.json()
+    return {
+        "id": user_data.get('sub', user_data.get('email', 'unknown')),
+        "email": user_data.get('email', 'unknown'),
+    }
+
+@router.post("/api/logout")
 def logout(request: Request):
+    """
+    Clears the server-side session.
+    """
+    request.session.pop("user", None)
+    request.session.pop("access_token", None)
+    return JSONResponse(content={"message": "Logged out successfully"})
+
+@router.get("/api/logout")
+def logout_get(request: Request):
+    """Fallback GET logout endpoint (original behavior)"""
     request.session.pop("user", None)
+    request.session.pop("access_token", None)
     return RedirectResponse(config.REDIRECT_URI)
\ No newline at end of file
diff --git a/be/tests/routes/test_api_auth.py b/be/tests/routes/test_api_auth.py
index acc622f..4aafcae 100644
--- a/be/tests/routes/test_api_auth.py
+++ b/be/tests/routes/test_api_auth.py
@@ -52,7 +52,7 @@ def test_get_token_success(mock_requests_get, mock_requests_post, client: TestCl
     response = client.post("/api/auth/token", json={"code": "test-code"})
 
     assert response.status_code == 200
-    assert response.json() == "user@example.com"
+    assert response.json() == {'email': 'user@example.com', 'id': 'user@example.com'}
     # Check that the session was set
     assert client.cookies.get("session") is not None
 
@@ -67,7 +67,7 @@ def test_get_token_failure(mock_requests_post, client: TestClient):
 def test_logout(client: TestClient):
     """Test that the logout endpoint returns a redirect."""
     # We test the direct outcome (a redirect response) rather than inspect session state
-    response = client.get("/api/logout", follow_redirects=False)
+    response = client.post("/api/logout", follow_redirects=False)
     # Check for a redirect status code (307 is used by FastAPI for temporary redirects)
-    assert response.status_code == 307
+    assert client.cookies.get("session") is None
 
diff --git a/fe/src/lib/stores.js b/fe/src/lib/stores.js
index c4152ca..9f63005 100644
--- a/fe/src/lib/stores.js
+++ b/fe/src/lib/stores.js
@@ -4,5 +4,7 @@ export const selectedNamespce   = writable(null);
 export const selectedTable      = writable(null);
 export const sample_limit       = writable(100);
 
+export const user = writable(null);
+
 export const healthEnabled = writable(false);
 export const HEALTH_DISABLED_MESSAGE = 'Feature is disabled. Please contact your app administrator or <a href="https://github.com/lakevision-project/lakevision?tab=readme-ov-file#configuration" target="_blank">read the documentation</a> to enable DB connection.';
\ No newline at end of file
diff --git a/fe/src/routes/+layout.svelte b/fe/src/routes/+layout.svelte
index 1358cd7..adf750c 100644
--- a/fe/src/routes/+layout.svelte
+++ b/fe/src/routes/+layout.svelte
@@ -1,136 +1,179 @@
 <script>
-	import { env } from '$env/dynamic/public';
-	import { browser } from '$app/environment';
-	import 'carbon-components-svelte/css/all.css';
-	import '../app.css';
-	import { page } from '$app/stores';
-	import {
-		Header,
-		HeaderUtilities,
-		HeaderNavItem,
-		HeaderActionLink,
-		HeaderPanelLinks,
-		HeaderGlobalAction,
-		HeaderPanelLink,
-		HeaderAction,
-		Modal
-	} from 'carbon-components-svelte';
-
-	import LogoGithub from 'carbon-icons-svelte/lib/LogoGithub.svelte';
-	import { onMount } from 'svelte';
-	import { goto } from '$app/navigation';
-	import { Logout, UserAvatarFilledAlt } from 'carbon-icons-svelte';
-	import { healthEnabled } from '$lib/stores';
-
-	let user;
-	let isHeaderActionOpen = false;
-	let AUTH_ENABLED = false;
-	let extra_links = [];
-	let extra_header_links = [];
-	let company = 'Apache Iceberg';
-	let platform = 'Lakevision';
-
-	onMount(() => {
-		if (env.PUBLIC_AUTH_ENABLED == 'true') {
-			AUTH_ENABLED = true;
-		}
-
-		if (env.PUBLIC_HEALTH_ENABLED == 'true') {
+    import { env } from '$env/dynamic/public';
+    import { browser } from '$app/environment';
+    import 'carbon-components-svelte/css/all.css';
+    import '../app.css';
+    import { page } from '$app/stores';
+    import {
+        Header,
+        HeaderUtilities,
+        HeaderNavItem,
+        HeaderActionLink,
+        HeaderPanelLinks,
+        HeaderGlobalAction,
+        HeaderPanelLink,
+        HeaderAction,
+        Modal
+    } from 'carbon-components-svelte';
+
+    import LogoGithub from 'carbon-icons-svelte/lib/LogoGithub.svelte';
+    import { onMount } from 'svelte';
+    import { goto } from '$app/navigation';
+    import { Logout, UserAvatarFilledAlt } from 'carbon-icons-svelte';
+    import { user, healthEnabled } from '$lib/stores'; 
+
+    const AUTH_ENABLED = (env.PUBLIC_AUTH_ENABLED || 'true').toLowerCase() === 'true';
+
+    let currentUser;
+    user.subscribe(value => {
+        currentUser = value;
+    });
+
+    let isHeaderActionOpen = false;
+    let extra_links = [];
+    let extra_header_links = [];
+    let company = 'Apache Iceberg';
+    let platform = 'Lakevision';
+
+    // --- Configuration for Session Management ---
+    const DEFAULT_AUTH_TOKEN_URL = '/api/auth/token';
+    const AUTH_TOKEN_EXCHANGE_URL = env.PUBLIC_AUTH_TOKEN_EXCHANGE_URL || DEFAULT_AUTH_TOKEN_URL;
+    const SESSION_CHECK_URL = env.PUBLIC_SESSION_CHECK_URL || '/api/auth/session'; 
+    // --------------------------------------------------
+
+    async function checkExistingSession() {
+        if (!AUTH_ENABLED) return;
+        console.log("Checking for existing session...");
+        try {
+            // Browser sends HttpOnly session cookie automatically
+            const response = await fetch(SESSION_CHECK_URL);
+
+            if (response.ok) {
+                const data = await response.json();
+                console.log("Session found, setting user:", data);
+                user.set(data);
+                showLogin = false;
+                return true;
+            } else {
+                console.log("No existing session found.");
+                return false;
+            }
+        } catch (error) {
+            console.error("Error checking session:", error);
+            return false;
+        }
+    }
+
+
+    onMount(async () => {
+        if (env.PUBLIC_HEALTH_ENABLED == 'true') {
             healthEnabled.set(true);
         } else {
             healthEnabled.set(false);
         }
-		if (env.PUBLIC_EXTRA_LINKS) {
+        if (env.PUBLIC_EXTRA_LINKS) {
             try {
                 extra_links = JSON.parse(env.PUBLIC_EXTRA_LINKS);
             } catch (e) {
                 console.error("Failed to parse PUBLIC_EXTRA_LINKS. Ensure it is valid JSON.", e);
             }
         }
-		if (env.PUBLIC_EXTRA_HEADER_LINKS) {
+        if (env.PUBLIC_EXTRA_HEADER_LINKS) {
             try {
                 extra_header_links = JSON.parse(env.PUBLIC_EXTRA_HEADER_LINKS);
             } catch (e) {
                 console.error("Failed to parse PUBLIC_EXTRA_HEADER_LINKS. Ensure it is valid JSON.", e);
             }
         }
-		if (env.PUBLIC_COMPANY_NAME) company = env.PUBLIC_COMPANY_NAME;
-		if (env.PUBLIC_PLATFORM_NAME) platform = env.PUBLIC_PLATFORM_NAME;
-		if (AUTH_ENABLED && user == null) {
-			const params = new URLSearchParams(window.location.search);
-			const code = params.get('code');
-			const state = params.get('state');
-			if (code) {
-				exchangeCodeForToken(code, state);
-			} else {
-				console.error('No authorization code found!');
-				login();
-			}
-		}
-	});
-
-	async function exchangeCodeForToken(code, state) {
-		const response = await fetch('/api/auth/token', {
-			method: 'POST',
-			headers: { 'Content-Type': 'application/json' },
-			body: JSON.stringify({ code }),
-			credentials: 'include'
-		});
-
-		if (response.ok) {
-			const data = await response.json();
-			console.log('Token received:', data);
-			user = data;
-
-			// Decode the state parameter and redirect, preserving the original URL query
-			const decodedState = decodeURIComponent(state || '');
-			if (decodedState) {
-				goto('/?' + decodedState);
-			} else {
-				// stay on the current path; don't wipe params
-				goto($page.url.pathname, { replaceState: true });
-			}
-		} else {
-			console.error('Error exchanging token');
-		}
-	}
-
-	const clientId = env.PUBLIC_OPENID_CLIENT_ID;
-	const openidProviderUrl = env.PUBLIC_OPENID_PROVIDER_URL + '/authorize';
-	const redirectUri = encodeURIComponent(env.PUBLIC_REDIRECT_URI);
-
-	function login() {
-		const params = new URLSearchParams(window.location.search);
-		const state = encodeURIComponent(params.toString());
-		window.location.href = `${openidProviderUrl}?client_id=${clientId}&redirect_uri=${redirectUri}&response_type=code&scope=openid%20profile%20email&state=${state}`;
-		showLogin = false;
-	}
-
-	async function logout() {
-		await fetch('/api/logout');
-		user = '';
-		return;
-	}
-
-	let showLogin = false;
-	let loginPosition = { top: 0, left: 0 };
-
-	function handleLogout(event) {
-		logout();
-		showLogin = true;
-		const rect = event.target.getBoundingClientRect();
-		loginPosition = {
-			top: rect.top + rect.height + window.scrollY,
-			left: rect.left + window.scrollX
-		};
-	}
+        if (env.PUBLIC_COMPANY_NAME) company = env.PUBLIC_COMPANY_NAME;
+        if (env.PUBLIC_PLATFORM_NAME) platform = env.PUBLIC_PLATFORM_NAME;
+
+        // Skip auth flow entirely when disabled; set a dev user so WS can connect.
+        if (!AUTH_ENABLED) {
+            user.set({"email":"dev-user@test.com"});
+            showLogin = false;
+            return;
+        }
+
+        const params = new URLSearchParams(window.location.search);
+        const code = params.get('code');
+        const state = params.get('state');
+
+        if (code) {
+            // 1. If code exists, exchange it (Redirect from IdP)
+            exchangeCodeForToken(code, state);
+        } else if (currentUser == null) {
+            // 2. If no code and no user, check for existing session cookie (Refresh)
+            const sessionFound = await checkExistingSession();
+            if (!sessionFound) {
+                // 3. If no session and no code, force login
+                console.error('No authorization code found! Redirecting to login.');
+                login();
+            }
+        }
+    });
+
+    async function exchangeCodeForToken(code, state) {
+        const response = await fetch(AUTH_TOKEN_EXCHANGE_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ code }),
+            credentials: 'include'
+        });
+
+        if (response.ok) {
+            const data = await response.json(); 
+            user.set(data);
+
+            // Decode the state parameter and redirect, preserving the original URL query
+            const decodedState = decodeURIComponent(state || '');
+            if (decodedState) {
+                goto('/?' + decodedState, { replaceState: true });
+            } else {
+                // stay on the current path, cleaning up the code/state params
+                goto($page.url.pathname, { replaceState: true });
+            }
+        } else {
+            console.error('Error exchanging token');
+            login(); // Redirect on failure
+        }
+    }
+
+    const clientId = env.PUBLIC_OPENID_CLIENT_ID;
+    const openidProviderUrl = env.PUBLIC_OPENID_PROVIDER_URL + '/authorize';
+    const redirectUri = encodeURIComponent(env.PUBLIC_REDIRECT_URI);
+
+    function login() {
+        if (!browser || !AUTH_ENABLED) return;
+        const params = new URLSearchParams(window.location.search);
+        const state = encodeURIComponent(params.toString());
+        window.location.href = `${openidProviderUrl}?client_id=${clientId}&redirect_uri=${redirectUri}&response_type=code&scope=openid%20profile%20email&state=${state}`;
+        showLogin = false;
+    }
+
+    async function logout() {
+        if (!AUTH_ENABLED) {
+            user.set(null); 
+            return;
+        }
+        await fetch('/api/logout', { method: 'POST' });
+        user.set(null); 
+        // Reload to clear client state and re-trigger session check (which will fail and redirect to login)
+        if (browser) window.location.reload();
+    }
+
+    let showLogin = false;
+
+    function handleLogout(event) {
+        logout();
+    }
 </script>
 
 <Header company="{company}" platformName="{platform}">
-	<HeaderNavItem href="/" text="Home" />
-	<HeaderNavItem href="/lh-health" text="Lakehouse Health" />
-	
-	{#if extra_header_links.length > 0}
+    <HeaderNavItem href="/" text="Home" />
+    <HeaderNavItem href="/lh-health" text="Lakehouse Health" />
+    
+    {#if extra_header_links.length > 0}
         {#each extra_header_links as link}
             <HeaderNavItem 
                 text="{link.text}" 
@@ -140,19 +183,19 @@
         {/each}
     {/if}
 
-	<HeaderUtilities>
-		<HeaderActionLink href="https://github.com/IBM/lakevision" target="_blank">
-			<LogoGithub slot="icon" size="{20}" />
-		</HeaderActionLink>
-		{#if AUTH_ENABLED}
-			<HeaderGlobalAction iconDescription="{user}" icon="{UserAvatarFilledAlt}" />
-			<HeaderGlobalAction
-				iconDescription="Logout"
-				icon="{Logout}"
-				on:click="{(event) => handleLogout(event)}"
-			/>
-		{/if}
-		{#if extra_links.length > 0}
+    <HeaderUtilities>
+        <HeaderActionLink href="https://github.com/IBM/lakevision" target="_blank">
+            <LogoGithub slot="icon" size="{20}" />
+        </HeaderActionLink>
+        {#if AUTH_ENABLED}
+            <HeaderGlobalAction iconDescription="{currentUser?.email || currentUser?.id || 'User'}" icon="{UserAvatarFilledAlt}" />
+            <HeaderGlobalAction
+                iconDescription="Logout"
+                icon="{Logout}"
+                on:click="{(event) => handleLogout(event)}"
+            />
+        {/if}
+        {#if extra_links.length > 0}
             <HeaderAction bind:isOpen="{isHeaderActionOpen}">
                 <HeaderPanelLinks>
                     {#each extra_links as link}
@@ -165,16 +208,16 @@
                 </HeaderPanelLinks>
             </HeaderAction>
         {/if}
-	</HeaderUtilities>
+    </HeaderUtilities>
 </Header>
 
 <Modal
-	bind:open="{showLogin}"
-	modalHeading="Login"
-	primaryButtonText="Login"
-	secondaryButtonText="Cancel"
-	on:click:button--secondary="{() => (showLogin = false)}"
-	on:submit="{login}"
+    bind:open="{showLogin}"
+    modalHeading="Login"
+    primaryButtonText="Login"
+    secondaryButtonText="Cancel"
+    on:click:button--secondary="{() => (showLogin = false)}"
+    on:submit="{login}"
 />
 
 <slot></slot>
\ No newline at end of file