diff --git a/src/Application/Users/UserService.cs b/src/Application/Users/UserService.cs
index edb28145..3655d093 100644
--- a/src/Application/Users/UserService.cs
+++ b/src/Application/Users/UserService.cs
@@ -119,7 +119,7 @@ private string GenerateJwtToken(User user)
             Subject = new ClaimsIdentity(CreateClaims(user)),
             Audience = _config[ConfigurationKeys.JwtIssuer],
             Issuer = _config[ConfigurationKeys.JwtIssuer],
-            Expires = DateTime.UtcNow.AddHours(1),
+            Expires = DateTime.Now.AddMonths(1),
             SigningCredentials =
                 new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature),
         };
diff --git a/src/Client/Client.csproj b/src/Client/Client.csproj
index 2d7ed339..342b9b7f 100644
--- a/src/Client/Client.csproj
+++ b/src/Client/Client.csproj
@@ -15,6 +15,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Blazored.SessionStorage" Version="2.2.0" />
     <PackageReference Include="Blazorise.Bootstrap5" Version="1.0.3" />
     <PackageReference Include="Blazorise.Icons.FontAwesome" Version="1.0.3" />
     <PackageReference Include="Blazorise.Markdown" Version="1.0.3" />
diff --git a/src/Client/Pages/Admin/AdminPage.razor b/src/Client/Pages/Admin/AdminPage.razor
index 3f23c206..ba70de64 100644
--- a/src/Client/Pages/Admin/AdminPage.razor
+++ b/src/Client/Pages/Admin/AdminPage.razor
@@ -4,36 +4,43 @@
 
 <h2>Adminsida</h2>
 
-<Tabs SelectedTab="@_selectedTab"
-      SelectedTabChanged="@OnSelectedTabChanged"
-      Justified="true"
-      Pills="true">
-    <Items>
-        <Tab Name="contracts">Hantera kontrakt</Tab>
-        <Tab Name="users">Hantera användare</Tab>
-    </Items>
-    <Content>
-        <TabPanel Name="contracts">
-            <ContractForm OnContractUploaded="AddContractToTable"/>
-            <ContractTable @ref="@_contractTable"/>
-        </TabPanel>
-        <TabPanel Name="users">
-            <UserForm OnUserAdded="AddUserToTable"/>
-            <UserTable @ref="@_userTable"/>
-        </TabPanel>
-    </Content>
-</Tabs>
+<!-- Extra div needed to style the Blazorise-components (see https://github.com/Megabit/Blazorise/issues/1599) -->
+<div>
+    <Tabs SelectedTab="@_selectedTab"
+          SelectedTabChanged="@OnSelectedTabChanged"
+          Justified="true"
+          Pills="true"
+          TextColor="TextColor.Primary"
+          Class="tabs">
+        <Items>
+            <Tab Name="contracts">Hantera kontrakt</Tab>
+            <Tab Name="users">Hantera användare</Tab>
+        </Items>
+        <Content>
+            <TabPanel Name="contracts">
+                <ContractForm @ref="_contractForm" OnContractUploaded="AddContractToTable"/>
+                <ContractTable @ref="@_contractTable" ContractOpeningForEdit="@OnContractOpeningForEdit"/>
+            </TabPanel>
+            <TabPanel Name="users">
+                <UserForm OnUserAdded="AddUserToTable"/>
+                <UserTable @ref="@_userTable"/>
+            </TabPanel>
+        </Content>
+    </Tabs>
+</div>
 
 @code {
 
     private string _selectedTab = "contracts";
 
+    // Null-forgiving operator used because these fields are set by the Blazor runtime using @ref
     private ContractTable _contractTable = null!;
     private UserTable _userTable = null!;
+    private ContractForm _contractForm = null!;
 
     private void AddContractToTable(Contract contract)
     {
-        _contractTable.Add(contract);
+        _contractTable.AddOrUpdate(contract);
     }
 
     private void AddUserToTable(User user)
@@ -46,4 +53,10 @@
         _selectedTab = tabName;
         return Task.CompletedTask;
     }
+
+    private async Task OnContractOpeningForEdit(Contract contract)
+    {
+        await _contractForm.EditContractAsync(contract);
+    }
+
 }
diff --git a/src/Client/Pages/Admin/AdminPage.razor.css b/src/Client/Pages/Admin/AdminPage.razor.css
new file mode 100644
index 00000000..86ba7676
--- /dev/null
+++ b/src/Client/Pages/Admin/AdminPage.razor.css
@@ -0,0 +1,4 @@
+::deep .nav-link {
+    background: #e7e7e7;
+    color: var(--prodigo-dark-blue)
+}
diff --git a/src/Client/Pages/Admin/ContractForm.razor b/src/Client/Pages/Admin/ContractForm.razor
index d67ec07f..7d4d9adc 100644
--- a/src/Client/Pages/Admin/ContractForm.razor
+++ b/src/Client/Pages/Admin/ContractForm.razor
@@ -6,8 +6,9 @@
 @using Blazorise.Markdown
 @inject ILogger<AdminPage> _logger
 @inject HttpClient _http
+@inject IJSRuntime _js
 
-<h4>Skapa nytt kontrakt</h4>
+<h4 id="contract-form-title">Skapa nytt kontrakt</h4>
 
 <EditForm Model="@_contract" OnSubmit="OnSubmit">
 
@@ -101,6 +102,38 @@
 
         private const string MinFormHeight = "5rem";
 
+    /// <summary>
+    /// Populates the form with the values of the given <see cref="Contract"/>.
+    /// </summary>
+    /// <param name="contract">The data to edit.</param>
+    public async Task EditContractAsync(Contract contract)
+    {
+        await _js.InvokeVoidAsync("scrollToElement", "#contract-form-title");
+        _shouldRender = true;
+        _contract = contract;
+        await DownloadContractFiles();
+    }
+
+    private async Task DownloadContractFiles()
+    {
+        await DownloadContractFile(_contract.InspirationalImagePath, content => _inspirationalContent = content);
+        await DownloadContractFile(_contract.SupplierLogoImagePath, content => _supplierLogoContent = content);
+        await DownloadContractFile(_contract.AdditionalDocument, content => _additionalDocumentContent = content);
+    }
+
+    private async Task DownloadContractFile(string path, Action<MultipartFormDataContent> setContent)
+    {
+
+        var fileUri = new Uri(Path.Join(_http.BaseAddress?.ToString(), path[1..]), UriKind.Absolute);
+
+        HttpResponseMessage response = await _http.GetAsync(fileUri);
+        string mediaType = response.Content.Headers.ContentType?.MediaType ?? "images/jpeg";
+        Stream stream = await response.Content.ReadAsStreamAsync();
+
+        MultipartFormDataContent content = CreateFormDataContent(stream, fileUri.Segments.Last(), mediaType);
+        setContent(content);
+    }
+
     private static Contract CreateEmptyContract()
     {
         return new Contract
@@ -126,34 +159,37 @@
     {
         _shouldRender = false;
 
-        content = new MultipartFormDataContent();
-        StreamContent fileContent;
-
         const long bitsInAKilobyte = 1024;
         const long kilobytesInAMegabyte = 1024;
         const long maxFileSize = bitsInAKilobyte * kilobytesInAMegabyte * 100;
 
+        Stream fileStream = arg.File.OpenReadStream(maxFileSize);
+
+        content = CreateFormDataContent(fileStream, arg.File.Name, arg.File.ContentType);
+
+        _shouldRender = true;
+    }
+
+    private MultipartFormDataContent CreateFormDataContent(Stream fileStream, string fileName, string contentType)
+    {
+        StreamContent fileContent;
+
         try
         {
-            fileContent = new StreamContent(arg.File.OpenReadStream(maxFileSize));
+            fileContent = new StreamContent(fileStream);
         }
         catch (IOException ex)
         {
-            _logger.LogInformation(
-                "{FileName} not uploaded: {Message}",
-                arg.File.Name, ex.Message);
-            return;
+            _logger.LogInformation("{FileName} not uploaded: {Message}", fileName, ex.Message);
+            throw;
         }
 
-        fileContent.Headers.ContentType =
-            new MediaTypeHeaderValue(arg.File.ContentType);
+        fileContent.Headers.ContentType = new MediaTypeHeaderValue(contentType);
 
-        content.Add(
-            fileContent,
-            "\"file\"",
-            arg.File.Name);
+        var content = new MultipartFormDataContent();
+        content.Add(fileContent, "\"file\"", fileName);
 
-        _shouldRender = true;
+        return content;
     }
 
     private async Task OnSubmit()
@@ -192,12 +228,11 @@
     {
         string json = JsonConvert.SerializeObject(_contract);
         var content = new StringContent(json, Encoding.UTF8, "application/json");
-        HttpResponseMessage response = await _http.PostAsync("/api/v1/contracts", content);
+        HttpResponseMessage response = await _http.PutAsync($"/api/v1/contracts/{_contract.Id}", content);
         if (response.IsSuccessStatusCode)
         {
             await OnContractUploaded.InvokeAsync(_contract);
             _contract = CreateEmptyContract();
         }
     }
-
 }
diff --git a/src/Client/Pages/Admin/ContractTable.razor b/src/Client/Pages/Admin/ContractTable.razor
index f9270292..b349b5a7 100644
--- a/src/Client/Pages/Admin/ContractTable.razor
+++ b/src/Client/Pages/Admin/ContractTable.razor
@@ -12,6 +12,7 @@
             <tr>
                 <th scope="col">Kontraktnamn</th>
                 <th scope="col">Företag</th>
+                <th scope="col">Redigera</th>
                 <th scope="col">Ta bort</th>
             </tr>
         </thead>
@@ -19,7 +20,10 @@
         <tbody>
         @foreach (Contract contract in contracts)
         {
-            <ContractTableRow Contract=@contract OnContractRemoved=@Remove/>
+            <ContractTableRow @key="@contract.Id"
+                              Contract=@contract
+                              OnContractRemoved=@Remove
+                              ContractOpeningForEdit="@(async () => await ContractOpeningForEdit.InvokeAsync(contract))"/>
         }
         </tbody>
     </table>
@@ -28,18 +32,35 @@
 
 @code {
 
-    private FetchData<List<Contract>> _dataFetcher = null!;
+    /// <summary>
+    /// Called when a <see cref="Contract"/> is being opened to be edited.
+    /// </summary>
+    [Parameter]
+    public EventCallback<Contract> ContractOpeningForEdit { get; set; } = EventCallback<Contract>.Empty;
 
     /// <summary>
     /// Adds a contract to the list.
     /// </summary>
     /// <param name="contract">The contract to add.</param>
-    public void Add(Contract contract)
+    public void AddOrUpdate(Contract contract)
     {
-        _dataFetcher.Data?.Add(contract);
+        if (_dataFetcher.Data is null)
+            return;
+
+        if (_dataFetcher.Data.Any(other => other.Id == contract.Id))
+        {
+            _dataFetcher.Data.RemoveAll(toRemove => toRemove.Id == contract.Id);
+            _dataFetcher.Data.Add(contract);
+        }
+        else
+        {
+            _dataFetcher.Data.Add(contract);
+        }
         InvokeAsync(StateHasChanged);
     }
 
+    private FetchData<List<Contract>> _dataFetcher = null!;
+
     /// <summary>
     /// Removes a contract from the list.
     /// </summary>
diff --git a/src/Client/Pages/Admin/ContractTableRow.razor b/src/Client/Pages/Admin/ContractTableRow.razor
index e8dc756a..2ba10805 100644
--- a/src/Client/Pages/Admin/ContractTableRow.razor
+++ b/src/Client/Pages/Admin/ContractTableRow.razor
@@ -7,29 +7,45 @@
 
     <td>@Contract.SupplierName</td>
 
+    <td>
+        <button type="button"
+                class="btn btn-outline-primary m-0"
+                @onclick="@(async () => await ContractOpeningForEdit.InvokeAsync(Contract))">
+            <span class="oi oi-pencil"></span>
+        </button>
+    </td>
+
     <!-- Button trigger modal -->
     <td>
-        <button type="button" class="btn btn-danger m-0" data-bs-toggle="modal" data-bs-target="#@($"modal_{Contract.Id}")">
+        <button type="button"
+                class="btn btn-danger m-0"
+                data-bs-toggle="modal"
+                data-bs-target="#@($"modal_{Contract.Id}")">
             <span class="oi oi-trash"></span>
         </button>
     </td>
 
-        <RemoveModal
-        Id=@Contract.Id
-        Title="Ta bort kontrakt"
-        Message="@($"Vill du ta bort kontraktet {Contract.Name}?")"
-        RemovalConfirmed="@(async () => await OnContractRemoved.InvokeAsync(Contract))"
-    />
+    <RemoveModal
+    Id=@Contract.Id
+    Title="Ta bort kontrakt"
+    Message="@($"Vill du ta bort kontraktet {Contract.Name}?")"
+    RemovalConfirmed="@(async () => await OnContractRemoved.InvokeAsync(Contract))"/>
 </tr>
 
 
 @code {
+
     /// <summary>
     /// Called when a contract has been removed successfully.
     /// </summary>
     [Parameter]
     public EventCallback<Contract> OnContractRemoved { get; set; } = EventCallback<Contract>.Empty;
 
+    /// <summary>
+    /// Called when a <see cref="Contract"/> is being opened to be edited.
+    /// </summary>
+    [Parameter]
+    public EventCallback<Contract> ContractOpeningForEdit { get; set; } = EventCallback<Contract>.Empty;
 
     /// <summary>
     /// The contract.
diff --git a/src/Client/Pages/Contracts/ContractDetails.razor b/src/Client/Pages/Contracts/ContractDetails.razor
index 4341e7e5..a78a9259 100644
--- a/src/Client/Pages/Contracts/ContractDetails.razor
+++ b/src/Client/Pages/Contracts/ContractDetails.razor
@@ -1,5 +1,6 @@
 @using Domain.Contracts
 @using System.Runtime.Serialization
+@inject ISessionService _session
 
 <!-- modal-dialog-scrollable -->
 <div class="modal w-100" id="@("id_" + Contract.Id)">
@@ -96,13 +97,7 @@
     [Parameter, EditorRequired,]
     public Contract Contract { get; set; } = null!;
 
-    /// <summary>
-    /// The name of the currently logged in user.
-    /// </summary>
-    [CascadingParameter(Name = nameof(LoggedInUser))]
-    public string? LoggedInUser { get; set; }
-
-    private bool ShouldHideDetails => string.IsNullOrEmpty(LoggedInUser);
+    private bool ShouldHideDetails => !_session.IsAuthenticated;
 
     private string ImagePath => string.IsNullOrEmpty(Contract.InspirationalImagePath) ?
         Contract.SupplierLogoImagePath :
diff --git a/src/Client/Pages/Contracts/RecentlyViewed.razor b/src/Client/Pages/Contracts/RecentlyViewed.razor
index 81bfff66..f4dd862e 100644
--- a/src/Client/Pages/Contracts/RecentlyViewed.razor
+++ b/src/Client/Pages/Contracts/RecentlyViewed.razor
@@ -2,11 +2,13 @@
 @using Application.Contracts
 @using System.Collections.ObjectModel
 @inject HttpClient _http
+@inject ISessionService _session
+@inherits AuthenticatedView
 
 <FetchData TData="Contract[]"
            Url="/api/v1/contracts/recent"
            Context="recents"
-           ShouldShowErrors="@false">
+           ShouldShowErrors="@_session.IsAuthenticated">
 
     <!-- No loading indicator. -->
     <LoadingIndicator></LoadingIndicator>
diff --git a/src/Client/Program.cs b/src/Client/Program.cs
index 79132770..ddc36cb5 100644
--- a/src/Client/Program.cs
+++ b/src/Client/Program.cs
@@ -1,8 +1,11 @@
+using Blazored.SessionStorage;
+
 using Blazorise;
 using Blazorise.Bootstrap5;
 using Blazorise.Icons.FontAwesome;
 
 using Client;
+using Client.Services.Authentication;
 
 using Microsoft.AspNetCore.Components.Web;
 using Microsoft.AspNetCore.Components.WebAssembly.Hosting;
@@ -16,6 +19,8 @@
 builder.Services
        .AddBlazorise(options => { options.Immediate = true; })
        .AddBootstrap5Providers()
-       .AddFontAwesomeIcons();
+       .AddFontAwesomeIcons()
+       .AddBlazoredSessionStorage()
+       .AddScoped<ISessionService, SessionManagerService>(); // Scoped behaves like Singleton.
 
 await builder.Build().RunAsync().ConfigureAwait(false);
diff --git a/src/Client/Services/Authentication/AuthenticationEventArgs.cs b/src/Client/Services/Authentication/AuthenticationEventArgs.cs
new file mode 100644
index 00000000..756e0776
--- /dev/null
+++ b/src/Client/Services/Authentication/AuthenticationEventArgs.cs
@@ -0,0 +1,14 @@
+using Application.Users;
+
+namespace Client.Services.Authentication;
+
+/// <summary>
+/// Contains information about an authentication changed event.
+/// </summary>
+public class AuthenticationEventArgs : EventArgs
+{
+    /// <summary>
+    /// Gets or sets the authentication state associated with this event.
+    /// </summary>
+    public AuthenticateResponse? State { get; set; }
+}
diff --git a/src/Client/Services/Authentication/ISessionService.cs b/src/Client/Services/Authentication/ISessionService.cs
new file mode 100644
index 00000000..ee238f0d
--- /dev/null
+++ b/src/Client/Services/Authentication/ISessionService.cs
@@ -0,0 +1,43 @@
+using Application.Users;
+
+namespace Client.Services.Authentication;
+
+/// <summary>
+/// Manages the session of the current user.
+/// </summary>
+public interface ISessionService
+{
+    /// <summary>
+    /// Called whenever there are changes to the authentication of the user in the current session.
+    /// </summary>
+    event EventHandler<AuthenticationEventArgs> AuthenticationStateChanged;
+
+    /// <summary>
+    /// Gets a value indicating whether the current session is authenticated.
+    /// </summary>
+    bool IsAuthenticated { get; }
+
+    /// <summary>
+    /// Gets the name of the currently authenticated user, if authenticated.
+    /// </summary>
+    string? Username { get; }
+
+    /// <summary>
+    /// Begins a new authenticated user session.
+    /// </summary>
+    /// <param name="authentication">The authentication used to identify the user.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    Task BeginAsync(AuthenticateResponse authentication);
+
+    /// <summary>
+    /// Ends the current authenticated user session.
+    /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    Task EndAsync();
+
+    /// <summary>
+    /// Tries to resume a user session from the already available data.
+    /// </summary>
+    /// <returns>The task result contains the whether it succeeded.</returns>
+    Task<bool> TryResumeAsync();
+}
diff --git a/src/Client/Services/Authentication/SessionManagerService.cs b/src/Client/Services/Authentication/SessionManagerService.cs
new file mode 100644
index 00000000..b4ab9cc3
--- /dev/null
+++ b/src/Client/Services/Authentication/SessionManagerService.cs
@@ -0,0 +1,85 @@
+using System.Net.Http.Headers;
+
+using Application.Users;
+
+using Blazored.SessionStorage;
+
+using Microsoft.AspNetCore.Components;
+
+namespace Client.Services.Authentication;
+
+/// <summary>
+/// Manages the session by storing it in the local session storage of the browser.
+/// </summary>
+internal class SessionManagerService : ISessionService
+{
+    private readonly ISessionStorageService _storage;
+    private readonly HttpClient _http;
+    private readonly NavigationManager _navigationManager;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="SessionManagerService"/> class.
+    /// </summary>
+    /// <param name="storage">A way to store session data.</param>
+    /// <param name="http">The client to add authentication tokens to.</param>
+    /// <param name="navigationManager">The window navigation controller.</param>
+    public SessionManagerService(ISessionStorageService storage, HttpClient http, NavigationManager navigationManager)
+    {
+        _storage = storage;
+        _http = http;
+        _navigationManager = navigationManager;
+    }
+
+    /// <inheritdoc/>
+    public event EventHandler<AuthenticationEventArgs>? AuthenticationStateChanged;
+
+    /// <inheritdoc/>
+    public bool IsAuthenticated { get; private set; }
+
+    /// <inheritdoc/>
+    public string? Username { get; private set; }
+
+    /// <inheritdoc/>
+    public async Task BeginAsync(AuthenticateResponse authentication)
+    {
+        await _storage.SetItemAsync("user", authentication).ConfigureAwait(true);
+
+        Authenticate(authentication);
+    }
+
+    /// <inheritdoc/>
+    public async Task EndAsync()
+    {
+        await _storage.RemoveItemAsync("user").ConfigureAwait(true);
+
+        _http.DefaultRequestHeaders.Authorization = null;
+
+        IsAuthenticated = false;
+        Username = null;
+
+        AuthenticationStateChanged?.Invoke(this, new AuthenticationEventArgs { State = null, });
+        _navigationManager.NavigateTo("/");
+    }
+
+    /// <inheritdoc/>
+    public async Task<bool> TryResumeAsync()
+    {
+        IsAuthenticated = await _storage.ContainKeyAsync("user").ConfigureAwait(true);
+        if (!IsAuthenticated)
+            return false;
+
+        AuthenticateResponse state = await _storage.GetItemAsync<AuthenticateResponse>("user").ConfigureAwait(true);
+        Authenticate(state);
+        return true;
+    }
+
+    private void Authenticate(AuthenticateResponse authentication)
+    {
+        // Store token on http client so all future requests use the token.
+        _http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", authentication.Token);
+        Console.WriteLine($"setting bearer to {_http.DefaultRequestHeaders.Authorization}");
+        IsAuthenticated = true;
+        Username = authentication.Username;
+        AuthenticationStateChanged?.Invoke(this, new AuthenticationEventArgs { State = authentication, });
+    }
+}
diff --git a/src/Client/Shared/AuthenticatedView.razor b/src/Client/Shared/AuthenticatedView.razor
new file mode 100644
index 00000000..123ad987
--- /dev/null
+++ b/src/Client/Shared/AuthenticatedView.razor
@@ -0,0 +1,11 @@
+@inject ISessionService Session
+
+@code {
+
+    /// <inheritdoc />
+    protected override void OnInitialized()
+    {
+        Session.AuthenticationStateChanged += (_, _) => StateHasChanged();
+    }
+
+}
diff --git a/src/Client/Shared/FetchData.razor b/src/Client/Shared/FetchData.razor
index d51c28e9..4279b4d7 100644
--- a/src/Client/Shared/FetchData.razor
+++ b/src/Client/Shared/FetchData.razor
@@ -2,6 +2,7 @@
 @using System.Net
 @typeparam TData
 @inject HttpClient _http;
+@inherits AuthenticatedView
 
 @if (_errorMessage is not null && ShouldShowErrors)
 {
@@ -51,9 +52,10 @@ else
     private string? _errorMessage;
 
     /// <inheritdoc />
-    protected override async Task OnInitializedAsync()
+    protected override async Task OnAfterRenderAsync(bool firstRender)
     {
-        await Fetch(Url);
+        if (Data is null && _errorMessage is null)
+            await Fetch(Url);
     }
 
     /// <summary>
@@ -61,15 +63,19 @@ else
     /// </summary>
     public async Task Fetch(string url)
     {
+        Console.WriteLine($"fetching with {_http.DefaultRequestHeaders.Authorization}");
         HttpResponseMessage response = await _http.GetAsync(url);
 
         if (!response.IsSuccessStatusCode)
         {
             _errorMessage = CreateErrorMessage(response.StatusCode);
+            StateHasChanged();
             return;
         }
 
         Data = await response.Content.ReadFromJsonAsync<TData>();
+        _errorMessage = null;
+        StateHasChanged();
     }
 
     private string CreateErrorMessage(HttpStatusCode statusCode)
diff --git a/src/Client/Shared/LogInButton.razor b/src/Client/Shared/LogInButton.razor
deleted file mode 100644
index 9c30179d..00000000
--- a/src/Client/Shared/LogInButton.razor
+++ /dev/null
@@ -1,13 +0,0 @@
-@inject IJSRuntime _js
-
-<button id="login-button" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#log-in" @onclick="OnClick">
-    Logga in
-</button>
-
-@code {
-    private async Task OnClick()
-    {
-        // Focuses the username text input element.
-        await _js.InvokeVoidAsync("focusElement", "#username");
-    }
-}
diff --git a/src/Client/Shared/Login/Login.razor b/src/Client/Shared/Login/Login.razor
new file mode 100644
index 00000000..e12105a5
--- /dev/null
+++ b/src/Client/Shared/Login/Login.razor
@@ -0,0 +1,33 @@
+@using Blazorise.Extensions
+@using System.Net.Http.Headers
+@inject IJSRuntime Js
+@inject ISessionService Session
+@inherits AuthenticatedView
+
+@if (Session.IsAuthenticated)
+{
+    <div class="d-flex flex-row align-items-center">
+        <p id="logged-in" class="text-center m-0">
+            Inloggad som: @Session.Username
+        </p>
+        <button id="logout-button" class="btn btn-link" @onclick="@(async () => await Session.EndAsync())">Logga ut</button>
+    </div>
+}
+else
+{
+    <button id="login-button"
+            class="btn btn-primary"
+            data-bs-toggle="modal"
+            data-bs-target="#log-in"
+            @onclick="FocusUsernameField">
+        Logga in
+    </button>
+}
+@code {
+
+    private async Task FocusUsernameField()
+    {
+        // Focuses the username text input element.
+        await Js.InvokeVoidAsync("focusElement", "#username");
+    }
+}
diff --git a/src/Client/Shared/Login/Login.razor.css b/src/Client/Shared/Login/Login.razor.css
new file mode 100644
index 00000000..bf109a8a
--- /dev/null
+++ b/src/Client/Shared/Login/Login.razor.css
@@ -0,0 +1,3 @@
+#logged-in {
+    color: var(--prodigo-white);
+}
diff --git a/src/Client/Shared/LoginModal.razor b/src/Client/Shared/Login/LoginModal.razor
similarity index 79%
rename from src/Client/Shared/LoginModal.razor
rename to src/Client/Shared/Login/LoginModal.razor
index d376d691..e48b1dc5 100644
--- a/src/Client/Shared/LoginModal.razor
+++ b/src/Client/Shared/Login/LoginModal.razor
@@ -1,11 +1,15 @@
 @using System.ComponentModel.DataAnnotations
 @using System.Net.Http.Headers
 @using Application.Users
+@using Blazored.SessionStorage
 @using Blazorise.Extensions
+@using Client.Services.Authentication
 @using Domain.Users
+@inherits AuthenticatedView
 @inject HttpClient _http
 @inject IJSRuntime _js
 @inject NavigationManager _navigationManager
+@inject ISessionService _session
 
 <div class="modal" id="log-in">
     <div class="modal-dialog">
@@ -25,7 +29,7 @@
 
                         @if (_logInFailed)
                         {
-                            <p class="text-danger">Inloggningen misslyckades </p>
+                            <p class="text-danger">Inloggningen misslyckades</p>
                         }
                     </div>
                     <div class="login-footer">
@@ -42,12 +46,6 @@
     User _user = new (){ Name = "", Password = "", };
     bool _logInFailed = false;
 
-    /// <summary>
-    /// Called when the username is changed.
-    /// </summary>
-    [Parameter]
-    public EventCallback<string> OnUserLogInChange { get; set; } = EventCallback<string>.Empty;
-
     private async Task ValidateUser()
     {
         HttpResponseMessage response = await _http.PostAsJsonAsync("/api/v1/users/authenticate", _user);
@@ -56,11 +54,16 @@
             _logInFailed = false;
 
             var authResponse = await response.Content.ReadFromJsonAsync<AuthenticateResponse>();
-            // Store token on http client so all future requests use the token.
-            // TODO: When making the login-state persist then this auth token should be stored in a cookie.
-            _http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", authResponse?.Token);
 
-            await OnUserLogInChange.InvokeAsync(_user.Name);
+            if (authResponse is null)
+            {
+                _logInFailed = true;
+                return;
+            }
+
+            // Begin new session.
+            await _session.BeginAsync(authResponse);
+
             await _js.InvokeVoidAsync("closeModal", "#log-in");
             _navigationManager.NavigateTo("dashboard");
         }
diff --git a/src/Client/Shared/LoginModal.razor.css b/src/Client/Shared/Login/LoginModal.razor.css
similarity index 100%
rename from src/Client/Shared/LoginModal.razor.css
rename to src/Client/Shared/Login/LoginModal.razor.css
diff --git a/src/Client/Shared/MainLayout.razor b/src/Client/Shared/MainLayout.razor
index 81ec7036..d2745cdc 100644
--- a/src/Client/Shared/MainLayout.razor
+++ b/src/Client/Shared/MainLayout.razor
@@ -1,5 +1,11 @@
-@inherits LayoutComponentBase
-<CascadingValue Value="@_loggedInUser" Name="LoggedInUser">
+@using System.Timers
+@inherits LayoutComponentBase
+@inject IJSRuntime Js
+@inject HttpClient Http
+@inject ISessionService Session
+@inject NavigationManager NavigationManager
+
+<CascadingValue Value="@Session" Name="Session">
     <ThemeProvider Theme="@_theme">
         <div class="page">
             <main>
@@ -8,7 +14,7 @@
                 </div>
                 <article class="content px-4">
                     @Body
-                    <LoginModal OnUserLogInChange="@OnUserLogIn"/>
+                    <LoginModal/>
                 </article>
             </main>
         </div>
@@ -17,14 +23,6 @@
 
 @code
 {
-    private void OnUserLogIn(string username)
-    {
-        _loggedInUser = username;
-        StateHasChanged();
-    }
-
-    private string? _loggedInUser = string.Empty;
-
     private readonly Theme _theme = new()
     {
         ColorOptions = new ThemeColorOptions
@@ -38,4 +36,35 @@
         },
         IsRounded = true,
     };
+
+        private const int InactivityLogoutMilliseconds = 1000 * 60 * 15; // 15 minutes
+
+    private readonly Timer _timer = new(InactivityLogoutMilliseconds);
+
+    /// <inheritdoc />
+    protected override async Task OnInitializedAsync()
+    {
+        await Session.TryResumeAsync();
+
+        _timer.Elapsed += LogOut;
+        _timer.AutoReset = false;
+
+        // Register JS-callbacks on the document that call ResetTimer when triggered.
+        await Js.InvokeVoidAsync("registerActivityCallback", DotNetObjectReference.Create(this));
+    }
+
+    /// <summary>
+    /// Resets the inactivity timer. Call when user has shown signs of activity.
+    /// </summary>
+    [JSInvokable]
+    public void ResetTimer()
+    {
+        _timer.Stop();
+        _timer.Start();
+    }
+
+    private void LogOut(object? sender, ElapsedEventArgs elapsedEventArgs)
+    {
+        InvokeAsync(async () => await Session.EndAsync());
+    }
 }
diff --git a/src/Client/Shared/NavMenu.razor b/src/Client/Shared/NavMenu.razor
index d4f7e8af..79d0f0fa 100644
--- a/src/Client/Shared/NavMenu.razor
+++ b/src/Client/Shared/NavMenu.razor
@@ -1,5 +1,7 @@
 @using Blazorise.Extensions
 @using Domain.Users
+@inherits AuthenticatedView
+@inject ISessionService _session
 
 <nav class="navbar navbar-expand-lg navbar-dark " style="background-color: #222939 ">
     <div class="container-fluid">
@@ -10,7 +12,7 @@
 
         <div class="collapse navbar-collapse" id="navbarNav">
             <ul class="navbar-nav me-auto mb-2 mb-lg-0 justify-content-center">
-                @if (!LoggedInUser.IsNullOrEmpty())
+                @if (_session.IsAuthenticated)
                 {
                     <li class="nav-item">
                         <NavLink class="nav-link" href="dashboard">
@@ -28,7 +30,7 @@
                         <span class="" aria-hidden="true"></span> Om oss
                     </NavLink>
                 </li>
-                @if (LoggedInUser == "admin")
+                @if (_session.Username == "admin")
                 {
 
                     <li id="admin-nav-item" class="nav-item">
@@ -38,28 +40,7 @@
                     </li>
                 }
             </ul>
-            <div>
-                @if (LoggedInUser.IsNullOrEmpty())
-                {
-                    <LogInButton />
-                }
-                else
-                {
-                    <p id="logged-in" class="text-center m-0">
-                        Inloggad som: @LoggedInUser
-                    </p>
-                }
-            </div>
+            <Login />
         </div>
     </div>
 </nav>
-
-@code {
-
-    /// <summary>
-    /// The name of the currently logged in user.
-    /// </summary>
-    [CascadingParameter(Name = nameof(LoggedInUser))]
-    public string? LoggedInUser { get; set; }
-
-}
diff --git a/src/Client/Shared/NavMenu.razor.css b/src/Client/Shared/NavMenu.razor.css
index c9694a97..d1889509 100644
--- a/src/Client/Shared/NavMenu.razor.css
+++ b/src/Client/Shared/NavMenu.razor.css
@@ -9,7 +9,3 @@
 .navbar {
     padding: 1rem 0;
 }
-
-#logged-in {
-    color: var(--prodigo-white);
-}
diff --git a/src/Client/_Imports.razor b/src/Client/_Imports.razor
index 391a45cc..09ed5866 100644
--- a/src/Client/_Imports.razor
+++ b/src/Client/_Imports.razor
@@ -11,4 +11,6 @@
 @using Client.Shared
 @using Client.Shared.Accordion
 @using Client.Shared.Lists
+@using Client.Shared.Login
 @using Client.Pages.Contracts
+@using Client.Services.Authentication
diff --git a/src/Client/wwwroot/css/app.css b/src/Client/wwwroot/css/app.css
index 7149f012..e6510f68 100644
--- a/src/Client/wwwroot/css/app.css
+++ b/src/Client/wwwroot/css/app.css
@@ -23,6 +23,10 @@ p {
     line-height: 1.8125rem;
 }
 
+h1, h2, h3, h4, h5, h6 {
+    scroll-margin-top: 4.5rem;
+}
+
 h1, h2 {
     font-family: 'Merriweather', Helvetica, Arial, sans-serif;
     letter-spacing: 0;
@@ -103,12 +107,12 @@ a, .btn-link {
     z-index: 1000;
 }
 
-    #blazor-error-ui .dismiss {
-        cursor: pointer;
-        position: absolute;
-        right: 0.75rem;
-        top: 0.5rem;
-    }
+#blazor-error-ui .dismiss {
+    cursor: pointer;
+    position: absolute;
+    right: 0.75rem;
+    top: 0.5rem;
+}
 
 .blazor-error-boundary {
     background: url(data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNTYiIGhlaWdodD0iNDkiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgeG1sbnM6eGxpbms9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmsiIG92ZXJmbG93PSJoaWRkZW4iPjxkZWZzPjxjbGlwUGF0aCBpZD0iY2xpcDAiPjxyZWN0IHg9IjIzNSIgeT0iNTEiIHdpZHRoPSI1NiIgaGVpZ2h0PSI0OSIvPjwvY2xpcFBhdGg+PC9kZWZzPjxnIGNsaXAtcGF0aD0idXJsKCNjbGlwMCkiIHRyYW5zZm9ybT0idHJhbnNsYXRlKC0yMzUgLTUxKSI+PHBhdGggZD0iTTI2My41MDYgNTFDMjY0LjcxNyA1MSAyNjUuODEzIDUxLjQ4MzcgMjY2LjYwNiA1Mi4yNjU4TDI2Ny4wNTIgNTIuNzk4NyAyNjcuNTM5IDUzLjYyODMgMjkwLjE4NSA5Mi4xODMxIDI5MC41NDUgOTIuNzk1IDI5MC42NTYgOTIuOTk2QzI5MC44NzcgOTMuNTEzIDI5MSA5NC4wODE1IDI5MSA5NC42NzgyIDI5MSA5Ny4wNjUxIDI4OS4wMzggOTkgMjg2LjYxNyA5OUwyNDAuMzgzIDk5QzIzNy45NjMgOTkgMjM2IDk3LjA2NTEgMjM2IDk0LjY3ODIgMjM2IDk0LjM3OTkgMjM2LjAzMSA5NC4wODg2IDIzNi4wODkgOTMuODA3MkwyMzYuMzM4IDkzLjAxNjIgMjM2Ljg1OCA5Mi4xMzE0IDI1OS40NzMgNTMuNjI5NCAyNTkuOTYxIDUyLjc5ODUgMjYwLjQwNyA1Mi4yNjU4QzI2MS4yIDUxLjQ4MzcgMjYyLjI5NiA1MSAyNjMuNTA2IDUxWk0yNjMuNTg2IDY2LjAxODNDMjYwLjczNyA2Ni4wMTgzIDI1OS4zMTMgNjcuMTI0NSAyNTkuMzEzIDY5LjMzNyAyNTkuMzEzIDY5LjYxMDIgMjU5LjMzMiA2OS44NjA4IDI1OS4zNzEgNzAuMDg4N0wyNjEuNzk1IDg0LjAxNjEgMjY1LjM4IDg0LjAxNjEgMjY3LjgyMSA2OS43NDc1QzI2Ny44NiA2OS43MzA5IDI2Ny44NzkgNjkuNTg3NyAyNjcuODc5IDY5LjMxNzkgMjY3Ljg3OSA2Ny4xMTgyIDI2Ni40NDggNjYuMDE4MyAyNjMuNTg2IDY2LjAxODNaTTI2My41NzYgODYuMDU0N0MyNjEuMDQ5IDg2LjA1NDcgMjU5Ljc4NiA4Ny4zMDA1IDI1OS43ODYgODkuNzkyMSAyNTkuNzg2IDkyLjI4MzcgMjYxLjA0OSA5My41Mjk1IDI2My41NzYgOTMuNTI5NSAyNjYuMTE2IDkzLjUyOTUgMjY3LjM4NyA5Mi4yODM3IDI2Ny4zODcgODkuNzkyMSAyNjcuMzg3IDg3LjMwMDUgMjY2LjExNiA4Ni4wNTQ3IDI2My41NzYgODYuMDU0N1oiIGZpbGw9IiNGRkU1MDAiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjwvZz48L3N2Zz4=) no-repeat 1rem/1.8rem, #b32121;
@@ -116,9 +120,9 @@ a, .btn-link {
     color: white;
 }
 
-    .blazor-error-boundary::after {
-        content: "An error has occurred."
-    }
+.blazor-error-boundary::after {
+    content: "An error has occurred."
+}
 
 
 table {
diff --git a/src/Client/wwwroot/js/interop.js b/src/Client/wwwroot/js/interop.js
index 520cb582..33faddee 100644
--- a/src/Client/wwwroot/js/interop.js
+++ b/src/Client/wwwroot/js/interop.js
@@ -8,3 +8,16 @@ function focusElement(selector) {
     const element = document.querySelector(selector);
     element.focus();
 }
+
+function registerActivityCallback(dotNetHelper) {
+    document.onmousemove = resetTimeDelay;
+    document.onkeydown = resetTimeDelay;
+
+    function resetTimeDelay() {
+        dotNetHelper.invokeMethodAsync("ResetTimer");
+    }
+}
+
+function scrollToElement(selector) {
+    document.querySelector(selector).scrollIntoView({behavior: 'smooth', block: 'start'});
+}
diff --git a/src/Server/Controllers/ContractsController.cs b/src/Server/Controllers/ContractsController.cs
index 6e786402..d05bce51 100644
--- a/src/Server/Controllers/ContractsController.cs
+++ b/src/Server/Controllers/ContractsController.cs
@@ -72,22 +72,22 @@ public IActionResult AddRecent(Contract contract)
     /// <summary>
     /// Creates a new contract.
     /// </summary>
-    /// <param name="contract">The contract to add.</param>
+    /// <param name="contract">The contract to put.</param>
+    /// <param name="id">The identifier of the contract to put.</param>
     /// <returns>The identifier of the stored image.</returns>
     /// <response code="400">The ID of the contract was already taken.</response>
-    [HttpPost]
+    [HttpPut("{id:guid}")]
     [Authorize("AdminOnly")]
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
-    public IActionResult CreateContract(Contract contract)
+    public IActionResult CreateContract([FromBody] Contract contract, Guid id)
     {
         try
         {
             _contracts.Add(contract);
         }
-        catch (IdentifierAlreadyTakenException e)
+        catch (IdentifierAlreadyTakenException)
         {
-            Logger.LogInformation("ID of contract was already taken: {Error}", e.Message);
-            return BadRequest();
+            _contracts.UpdateContract(contract);
         }
 
         return Ok();
diff --git a/src/Server/Program.cs b/src/Server/Program.cs
index e0f47a6a..0a8f8412 100644
--- a/src/Server/Program.cs
+++ b/src/Server/Program.cs
@@ -60,6 +60,12 @@
 builder.Services.AddControllers()
        .AddNewtonsoftJson();
 
+builder.Services.AddHttpLogging(logging =>
+{
+    logging.RequestHeaders.Add("authorization");
+    logging.ResponseHeaders.Add("WWW-Authenticate");
+});
+
 WebApplication app = builder.Build();
 
 // Configure the HTTP request pipeline.
diff --git a/tests/Client.Tests/Client.Tests.csproj b/tests/Client.Tests/Client.Tests.csproj
index ebcea7c0..d6cc9b50 100644
--- a/tests/Client.Tests/Client.Tests.csproj
+++ b/tests/Client.Tests/Client.Tests.csproj
@@ -16,6 +16,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Blazored.SessionStorage.TestExtensions" Version="2.2.0" />
     <PackageReference Include="Bogus" Version="34.0.2" />
     <PackageReference Include="bunit" Version="1.6.4" />
     <PackageReference Include="coverlet.msbuild" Version="3.1.2">
diff --git a/tests/Client.Tests/Pages/Admin/ContractListTests.cs b/tests/Client.Tests/Pages/Admin/ContractTableTests.cs
similarity index 74%
rename from tests/Client.Tests/Pages/Admin/ContractListTests.cs
rename to tests/Client.Tests/Pages/Admin/ContractTableTests.cs
index e81047bc..8656476b 100644
--- a/tests/Client.Tests/Pages/Admin/ContractListTests.cs
+++ b/tests/Client.Tests/Pages/Admin/ContractTableTests.cs
@@ -13,7 +13,7 @@
 
 namespace Client.Tests.Pages.Admin;
 
-public class ContractListTests : UITestFixture
+public class ContractTableTests : UITestFixture
 {
     [Fact]
     public void AddingContract_RendersTheNewContract()
@@ -30,7 +30,7 @@ public void AddingContract_RendersTheNewContract()
         var newContract = new Contract { Name = newContractName, };
 
         // Act
-        cut.Instance.Add(newContract);
+        cut.Instance.AddOrUpdate(newContract);
         cut.WaitForState(() => cut.FindAll(itemSelector).Count == 3);
 
         // Assert
@@ -55,7 +55,7 @@ public void AddingContract_DoesNotThrow_BeforeContractsAreFetched()
         var newContract = new Contract { Name = newContractName, };
 
         // Act
-        Action add = () => cut.Instance.Add(newContract);
+        Action add = () => cut.Instance.AddOrUpdate(newContract);
 
         // Assert
         add.Should().NotThrow();
@@ -68,7 +68,8 @@ public async Task RemovingContract_RendersWithoutTheContractAsync()
         var firstContract = new Contract() { Name = "first", };
         Contract[] contracts = { firstContract, new Contract() { Name = "Second", }, };
         MockHttp.When("/api/v1/contracts").RespondJson(contracts);
-        MockHttp.When(HttpMethod.Delete, $"/api/v1/contracts/{firstContract.Id}").Respond(req => new HttpResponseMessage(HttpStatusCode.OK));
+        MockHttp.When(HttpMethod.Delete, $"/api/v1/contracts/{firstContract.Id}")
+                .Respond(req => new HttpResponseMessage(HttpStatusCode.OK));
 
         IRenderedComponent<ContractTable> cut = Context.RenderComponent<ContractTable>();
         const string removeButton = "#confirm-remove";
@@ -83,4 +84,25 @@ public async Task RemovingContract_RendersWithoutTheContractAsync()
             elementWithNewName = contract => contract.TextContent.Contains(firstContract.Name);
         cut.FindAll(".contract-table-row").Should().NotContain(elementWithNewName);
     }
+
+    [Fact]
+    public void UpdatingContract_RendersNewContent_WhenContractExists()
+    {
+        // Arrange
+        var contract = new Contract() { Name = "old name", };
+        Contract[] contracts = { contract, };
+        MockHttp.When("/api/v1/contracts").RespondJson(contracts);
+
+        IRenderedComponent<ContractTable> cut = Context.RenderComponent<ContractTable>();
+        cut.WaitForAssertion(() => cut.Markup.Should().Contain(contract.Name));
+
+        const string newName = "new name";
+
+        // Act
+        contract.Name = newName;
+        cut.Instance.AddOrUpdate(contract);
+
+        // Assert
+        cut.WaitForAssertion(() => cut.Markup.Should().Contain(newName));
+    }
 }
diff --git a/tests/Client.Tests/Pages/Admin/UserListTests.cs b/tests/Client.Tests/Pages/Admin/UserTableTests.cs
similarity index 97%
rename from tests/Client.Tests/Pages/Admin/UserListTests.cs
rename to tests/Client.Tests/Pages/Admin/UserTableTests.cs
index 80ec5850..a990f953 100644
--- a/tests/Client.Tests/Pages/Admin/UserListTests.cs
+++ b/tests/Client.Tests/Pages/Admin/UserTableTests.cs
@@ -13,7 +13,7 @@
 
 namespace Client.Tests.Pages.Admin;
 
-public class UserListTests : UITestFixture
+public class UserTableTests : UITestFixture
 {
     [Fact]
     public void AddingUser_RendersTheNewUser()
diff --git a/tests/Client.Tests/Pages/Contracts/ContractDetailsTests.cs b/tests/Client.Tests/Pages/Contracts/ContractDetailsTests.cs
index ad7b3bbf..773fb788 100644
--- a/tests/Client.Tests/Pages/Contracts/ContractDetailsTests.cs
+++ b/tests/Client.Tests/Pages/Contracts/ContractDetailsTests.cs
@@ -1,19 +1,31 @@
-using AngleSharp.Dom;
+using System.Threading.Tasks;
+
+using AngleSharp.Dom;
+
+using Application.Users;
+
+using Blazored.SessionStorage;
 
 using Client.Pages.Contracts;
+using Client.Services.Authentication;
 
 using Domain.Contracts;
+using Domain.Users;
 
 using FluentAssertions.Execution;
 
+using Microsoft.Extensions.DependencyInjection;
+
 namespace Client.Tests.Pages.Contracts;
 
 public class ContractDetailsTests : UITestFixture
 {
     [Fact]
-    public void InspirationalImage_IsShown_WhenItExists()
+    public async Task InspirationalImage_IsShown_WhenItExists()
     {
         // Arrange
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
         const string inspirationalImagePath = "images/inspirational.jpg";
         const string logoImagePath = "images/logo.jpg";
         var contract = new Contract
@@ -40,9 +52,11 @@ void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> param
     }
 
     [Fact]
-    public void SupplierLogo_IsShown_WhenInspirationalImageDoesNotExist()
+    public async Task SupplierLogo_IsShown_WhenInspirationalImageDoesNotExist()
     {
         // Arrange
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
         const string inspirationalImagePath = "";
         const string logoImagePath = "images/logo.jpg";
         var contract = new Contract
@@ -69,9 +83,11 @@ void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> param
     }
 
     [Fact]
-    public void FAQSection_ContainsCorrectFAQ()
+    public async Task FAQSection_ContainsCorrectFAQ()
     {
         // Arrange
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
         string faqText = "Frequently asked question";
 
         var contract = new Contract { FAQ = faqText, };
@@ -89,9 +105,11 @@ void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> param
     }
 
     [Fact]
-    public void FAQSection_IsShown_WhenFAQExists()
+    public async Task FAQSection_IsShown_WhenFAQExists()
     {
         // Arrange
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
         var contract = new Contract { FAQ = "Frequently asked question", };
 
         void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> parameters) =>
@@ -107,9 +125,11 @@ void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> param
     }
 
     [Fact]
-    public void FAQSection_IsNotShown_WhenThereIsNoContractFAQ()
+    public async Task FAQSection_IsNotShown_WhenThereIsNoContractFAQ()
     {
         // Arrange
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
         var contract = new Contract { FAQ = string.Empty, };
 
         void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> parameters) =>
@@ -128,6 +148,8 @@ void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> param
     public void RegisterPrompt_IsShown_WhenUserIsNotLoggedIn()
     {
         // Arrange
+        MockSession.Setup(session => session.IsAuthenticated).Returns(false);
+
         void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> parameters) =>
             parameters.Add(property => property.Contract, new Contract());
 
@@ -140,12 +162,13 @@ void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> param
     }
 
     [Fact]
-    public void RegisterPrompt_IsNotShown_WhenUserIsLoggedIn()
+    public async Task RegisterPrompt_IsNotShown_WhenUserIsLoggedIn()
     {
         // Arrange
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
         void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> parameters) =>
-            parameters.Add(property => property.Contract, new Contract())
-                      .Add(property => property.LoggedInUser, "user-name");
+            parameters.Add(property => property.Contract, new Contract());
 
         // Act
         IRenderedComponent<ContractDetails> cut = Context.RenderComponent<ContractDetails>(ParameterBuilder);
@@ -156,9 +179,11 @@ void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> param
     }
 
     [Fact]
-    public void AdditionalDocumentSection_IsShown_WhenAdditionalDocumentExists()
+    public async Task AdditionalDocumentSection_IsShown_WhenAdditionalDocumentExists()
     {
         // Arrange
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
         var contract = new Contract { AdditionalDocument = "/link/to/additional.document", };
 
         void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> parameters) =>
@@ -172,9 +197,11 @@ void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> param
     }
 
     [Fact]
-    public void AdditionalDocumentSectionSection_IsNotShown_WhenThereIsNoAdditionalDocument()
+    public async Task AdditionalDocumentSectionSection_IsNotShown_WhenThereIsNoAdditionalDocument()
     {
         // Arrange
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
         var contract = new Contract { AdditionalDocument = string.Empty, };
 
         void ParameterBuilder(ComponentParameterCollectionBuilder<ContractDetails> parameters) =>
diff --git a/tests/Client.Tests/Shared/FetchDataTests.cs b/tests/Client.Tests/Shared/FetchDataTests.cs
index 5d07a15d..473f4e96 100644
--- a/tests/Client.Tests/Shared/FetchDataTests.cs
+++ b/tests/Client.Tests/Shared/FetchDataTests.cs
@@ -12,18 +12,20 @@ public class FetchDataTests : UITestFixture
     public void Render_RendersErrorMessage_WhenEndpointUnauthorized(HttpStatusCode errorCode)
     {
         // Arrange
+        MockSession.Setup(session => session.IsAuthenticated).Returns(false);
+
         const string endpointUrl = "/api/v1/example-endpoint";
         MockHttp.When(endpointUrl).Respond(errorCode);
 
         const string loading = "<p>loading</p>";
 
-        static void ParameterBuilder(ComponentParameterCollectionBuilder<FetchData<int>> parameters) =>
+        static void ParameterBuilder(ComponentParameterCollectionBuilder<FetchData<int?>> parameters) =>
             parameters.Add(property => property.Url, endpointUrl)
                       .Add(property => property.LoadingIndicator, loading)
                       .Add(property => property.ChildContent, _ => string.Empty);
 
         // Act
-        IRenderedComponent<FetchData<int>> cut = Context.RenderComponent<FetchData<int>>(ParameterBuilder);
+        IRenderedComponent<FetchData<int?>> cut = Context.RenderComponent<FetchData<int?>>(ParameterBuilder);
         cut.WaitForElement("#error-message");
 
         // Assert
diff --git a/tests/Client.Tests/Shared/Login/LoginTests.cs b/tests/Client.Tests/Shared/Login/LoginTests.cs
new file mode 100644
index 00000000..4c70e372
--- /dev/null
+++ b/tests/Client.Tests/Shared/Login/LoginTests.cs
@@ -0,0 +1,28 @@
+using System.Threading.Tasks;
+
+using Application.Users;
+
+using Client.Shared;
+
+using Microsoft.AspNetCore.Components.Web;
+
+namespace Client.Tests.Shared.Login;
+
+public class LoginTests : UITestFixture
+{
+    [Fact]
+    public async Task PressLogout_EndsSession_WhenUserWasAuthenticated()
+    {
+        // Arrange
+        MockSession.Setup(session => session.IsAuthenticated).Returns(true);
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
+        IRenderedComponent<NavMenu> cut = Context.RenderComponent<NavMenu>();
+
+        // Act
+        await cut.Find("#logout-button").ClickAsync(new MouseEventArgs());
+
+        // Assert
+        MockSession.Verify(session => session.EndAsync(), Times.Once);
+    }
+}
diff --git a/tests/Client.Tests/Shared/NavMenuTests.cs b/tests/Client.Tests/Shared/NavMenuTests.cs
index 25ee1ef2..579df0e9 100644
--- a/tests/Client.Tests/Shared/NavMenuTests.cs
+++ b/tests/Client.Tests/Shared/NavMenuTests.cs
@@ -1,46 +1,63 @@
-using Client.Shared;
+using System.Threading.Tasks;
+
+using Application.Users;
+
+using Client.Shared;
 
 namespace Client.Tests.Shared;
 
 public class NavMenuTests : UITestFixture
 {
     [Fact]
-    public void NavMenu_DisplaysLoginButton_WhenUserNotLoggedIn()
+    public async Task NavMenu_DisplaysLoginButton_WhenUserNotLoggedIn()
     {
         // Arrange
-        static void ParameterBuilder(ComponentParameterCollectionBuilder<NavMenu> parameters) =>
-            parameters.Add(property => property.LoggedInUser, string.Empty);
+        MockSession.Setup(session => session.IsAuthenticated).Returns(false);
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
 
         // Act
-        IRenderedComponent<NavMenu> cut = Context.RenderComponent<NavMenu>(ParameterBuilder);
+        IRenderedComponent<NavMenu> cut = Context.RenderComponent<NavMenu>();
 
         // Assert
         cut.Find("#login-button").Should().NotBeNull();
     }
 
     [Fact]
-    public void NavMenu_DisplaysLoginText_WhenUserLoggedIn()
+    public async Task NavMenu_DisplaysLogoutButton_WhenUserLoggedIn()
+    {
+        // Arrange
+        MockSession.Setup(session => session.IsAuthenticated).Returns(true);
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
+
+        // Act
+        IRenderedComponent<NavMenu> cut = Context.RenderComponent<NavMenu>();
+
+        // Assert
+        cut.Find("#logout-button").Should().NotBeNull();
+    }
+
+    [Fact]
+    public async Task NavMenu_DisplaysLoginText_WhenUserLoggedIn()
     {
         // Arrange
-        static void ParameterBuilder(ComponentParameterCollectionBuilder<NavMenu> parameters) =>
-            parameters.Add(property => property.LoggedInUser, "username");
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
 
         // Act
-        IRenderedComponent<NavMenu> cut = Context.RenderComponent<NavMenu>(ParameterBuilder);
+        IRenderedComponent<NavMenu> cut = Context.RenderComponent<NavMenu>();
 
         // Assert
         cut.Find("#logged-in").Should().NotBeNull();
     }
 
     [Fact]
-    public void NavMenu_DisplaysAdminNavItem_WhenAdminLoggedIn()
+    public async Task NavMenu_DisplaysAdminNavItem_WhenAdminLoggedIn()
     {
         // Arrange
-        static void ParameterBuilder(ComponentParameterCollectionBuilder<NavMenu> parameters) =>
-            parameters.Add(property => property.LoggedInUser, "admin");
+        MockSession.Setup(session => session.Username).Returns("admin");
+        await SessionStorage.SetItemAsync("user", new AuthenticateResponse(LoggedInUser, FakeToken));
 
         // Act
-        IRenderedComponent<NavMenu> cut = Context.RenderComponent<NavMenu>(ParameterBuilder);
+        IRenderedComponent<NavMenu> cut = Context.RenderComponent<NavMenu>();
 
         // Assert
         cut.Find("#admin-nav-item").Should().NotBeNull();
diff --git a/tests/Client.Tests/UITestFixture.cs b/tests/Client.Tests/UITestFixture.cs
index c8055af9..de928f60 100644
--- a/tests/Client.Tests/UITestFixture.cs
+++ b/tests/Client.Tests/UITestFixture.cs
@@ -1,13 +1,28 @@
-using Blazorise;
+using Blazored.SessionStorage;
+
+using Blazorise;
 using Blazorise.Bootstrap5;
 using Blazorise.Icons.FontAwesome;
 
+using Client.Services.Authentication;
+
+using Domain.Users;
+
+using Microsoft.Extensions.DependencyInjection;
+
 namespace Client.Tests;
 
 public class UITestFixture : IDisposable
 {
+    protected const string FakeToken = "fake-token";
+
     protected UITestFixture()
     {
+        SessionStorage = Context.AddBlazoredSessionStorage();
+        MockSession = new Mock<ISessionService>();
+        MockSession.Setup(session => session.IsAuthenticated).Returns(true);
+        Context.Services.AddScoped(_ => MockSession.Object);
+
         MockHttp = Context.Services.AddMockHttpClient();
         Context.JSInterop.Mode = JSRuntimeMode.Loose;
         Context.Services
@@ -16,6 +31,12 @@ protected UITestFixture()
                .AddFontAwesomeIcons();
     }
 
+    protected ISessionStorageService SessionStorage { get; }
+
+    protected Mock<ISessionService> MockSession { get; }
+
+    protected User LoggedInUser { get; } = new();
+
     protected TestContext Context { get; } = new TestContext();
 
     protected MockHttpMessageHandler MockHttp { get; }
diff --git a/tests/Infrastructure.Tests/Users/UserRepositoryTests.cs b/tests/Infrastructure.Tests/Users/UserRepositoryTests.cs
index 560389ad..a463df87 100644
--- a/tests/Infrastructure.Tests/Users/UserRepositoryTests.cs
+++ b/tests/Infrastructure.Tests/Users/UserRepositoryTests.cs
@@ -86,8 +86,8 @@ public void AfterCreation_ThereIsOnlyOneAdmin_IfAdminExistedPreviously()
         const string adminName = "admin";
         User? admin = _cut.All.FirstOrDefault(user => user.Name == adminName);
 
-        if (admin is null) // Ensure admin exists.
-            _cut.Add(new User { Name = adminName, });
+        if (admin is null)
+            _cut.EnsureAdminCreated();
 
         // Re-create database.
         EFDatabaseContext context = _fixture.CreateContext();
diff --git a/tests/Server.Tests.Integration/Authentication/AuthIntegrationTests.cs b/tests/Server.Tests.Integration/Authentication/AuthIntegrationTests.cs
index 787b5c68..0903f328 100644
--- a/tests/Server.Tests.Integration/Authentication/AuthIntegrationTests.cs
+++ b/tests/Server.Tests.Integration/Authentication/AuthIntegrationTests.cs
@@ -1,35 +1,27 @@
 using System.Net;
 using System.Net.Http;
-using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using System.Threading.Tasks;
-using Application.Configuration;
+
 using Application.Contracts;
-using Application.Users;
+
 using Domain.Contracts;
 using Domain.Users;
+
 using FluentAssertions.Execution;
 
 namespace Server.IntegrationTests.Authentication;
 
-public class AuthIntegrationTests : IClassFixture<TestWebApplicationFactory>
+public class AuthIntegrationTests : IntegrationTest
 {
-    private readonly HttpClient _client;
-
     public AuthIntegrationTests(TestWebApplicationFactory factory)
+        : base(factory)
     {
-        _client = factory.CreateClient();
-
-        Environment.SetEnvironmentVariable(
-            ConfigurationKeys.AdminPassword,
-            "test_password",
-            EnvironmentVariableTarget.Process);
     }
 
     public static IEnumerable<object[]> AdminPostApiEndpoints =>
         new List<object[]>
         {
-            new object[] { "/api/v1/contracts", JsonContent.Create(new Contract()), },
             new object[] { "/api/v1/users", JsonContent.Create(new User()), },
         };
 
@@ -37,10 +29,10 @@ public static IEnumerable<object[]> AdminDeleteApiEndpoints
     {
         get
         {
-            const string contractEndpoint = "/api/v1/contracts";
             var contract = new Contract();
+            string contractEndpoint = $"/api/v1/contracts/{contract.Id}";
             Func<HttpClient, Task> createContract =
-                async client => await client.PostAsJsonAsync(contractEndpoint, contract);
+                async client => await client.PutAsJsonAsync(contractEndpoint, contract);
 
             const string usersEndpoint = "/api/v1/users";
             var user = new User();
@@ -48,7 +40,7 @@ public static IEnumerable<object[]> AdminDeleteApiEndpoints
 
             return new List<object[]>
             {
-                new object[] { contractEndpoint + $"/{contract.Id}", createContract, },
+                new object[] { contractEndpoint, createContract, },
                 new object[] { usersEndpoint + $"/{user.Id}", createUser, },
             };
         }
@@ -61,7 +53,7 @@ public async Task GetApiEndpoints_ReturnsUnauthorized_WhenNoTokenIsSpecifiedAsyn
         // Arrange
 
         // Act
-        HttpResponseMessage response = await _client.GetAsync(endpointUrl);
+        HttpResponseMessage response = await Client.GetAsync(endpointUrl);
 
         // Assert
         response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
@@ -76,7 +68,7 @@ public async Task SendToAdminPostApiEndpoints_ReturnsUnauthorized_WhenTokenIsNot
         // Arrange
 
         // Act
-        HttpResponseMessage response = await _client.PostAsync(endpointUrl, content);
+        HttpResponseMessage response = await Client.PostAsync(endpointUrl, content);
 
         // Assert
         response.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
@@ -89,10 +81,10 @@ public async Task SendToAdminPostApiEndpoints_ReturnsForbidden_WhenUserTokenIsSp
         HttpContent content)
     {
         // Arrange
-        await ArrangeAuthenticatedUser();
+        await ArrangeAuthenticatedUserAsync();
 
         // Act
-        HttpResponseMessage response = await _client.PostAsync(endpointUrl, content);
+        HttpResponseMessage response = await Client.PostAsync(endpointUrl, content);
 
         // Assert
         response.StatusCode.Should().Be(HttpStatusCode.Forbidden);
@@ -105,10 +97,10 @@ public async Task SendToAdminPostApiEndpoints_IsSuccessful_WhenAdminIsAuthentica
         HttpContent content)
     {
         // Arrange
-        await ArrangeAuthenticatedAdmin();
+        await ArrangeAuthenticatedAdminAsync();
 
         // Act
-        HttpResponseMessage response = await _client.PostAsync(endpointUrl, content);
+        HttpResponseMessage response = await Client.PostAsync(endpointUrl, content);
 
         // Assert
         response.Should().BeSuccessful();
@@ -121,11 +113,11 @@ public async Task SendToAdminDeleteApiEndpoints_ReturnsForbidden_WhenUserTokenIs
         Func<HttpClient, Task> createResource)
     {
         // Arrange
-        await ArrangeAuthenticatedUser();
-        await createResource(_client);
+        await ArrangeAuthenticatedUserAsync();
+        await createResource(Client);
 
         // Act
-        HttpResponseMessage response = await _client.DeleteAsync(endpointUrl);
+        HttpResponseMessage response = await Client.DeleteAsync(endpointUrl);
 
         // Assert
         response.StatusCode.Should().Be(HttpStatusCode.Forbidden);
@@ -138,11 +130,11 @@ public async Task SendToAdminDeleteApiEndpoints_IsSuccessful_WhenAdminIsAuthenti
         Func<HttpClient, Task> createResource)
     {
         // Arrange
-        await ArrangeAuthenticatedAdmin();
-        await createResource(_client);
+        await ArrangeAuthenticatedAdminAsync();
+        await createResource(Client);
 
         // Act
-        HttpResponseMessage response = await _client.DeleteAsync(endpointUrl);
+        HttpResponseMessage response = await Client.DeleteAsync(endpointUrl);
 
         // Assert
         response.Should().BeSuccessful();
@@ -153,10 +145,10 @@ public async Task GetContractsApiEndpoint_ReturnsPreviewContent_WhenUserIsNotAut
     {
         // Arrange
         var contract = new Contract();
-        await ArrangeResource("/api/v1/contracts", contract);
+        await PutResourceAsync($"/api/v1/contracts/{contract.Id}", contract);
 
         // Act
-        HttpResponseMessage response = await _client.GetAsync("/api/v1/contracts");
+        HttpResponseMessage response = await Client.GetAsync("/api/v1/contracts");
 
         // Assert
         response.StatusCode.Should().Be(HttpStatusCode.OK);
@@ -180,10 +172,10 @@ public async Task GetContractsApiEndpoint_DoesNotReturnConfidentialContent_WhenU
     {
         // Arrange
         var contract = new Contract { Instructions = "very secret usage instructions", };
-        await ArrangeResource("/api/v1/contracts", contract);
+        await PutResourceAsync("/api/v1/contracts", contract);
 
         // Act
-        HttpResponseMessage response = await _client.GetAsync("/api/v1/contracts");
+        HttpResponseMessage response = await Client.GetAsync("/api/v1/contracts");
 
         // Assert
         response.StatusCode.Should().Be(HttpStatusCode.OK);
@@ -197,53 +189,16 @@ public async Task GetContractsApiEndpoint_ReturnsOkContent_WhenUserIsAuthenticat
     {
         // Arrange
         var contract = new Contract();
-        await ArrangeResource("/api/v1/contracts", contract);
+        await PutResourceAsync($"/api/v1/contracts/{contract.Id}", contract);
 
-        await ArrangeAuthenticatedUser();
+        await ArrangeAuthenticatedUserAsync();
 
         // Act
-        HttpResponseMessage response = await _client.GetAsync("/api/v1/contracts");
+        HttpResponseMessage response = await Client.GetAsync("/api/v1/contracts");
 
         // Assert
         response.StatusCode.Should().Be(HttpStatusCode.OK);
         var contracts = await response.Content.ReadFromJsonAsync<IEnumerable<Contract>>();
         contracts.Should().ContainEquivalentOf(contract);
     }
-
-    private async Task ArrangeResource<TResource>(string url, TResource resource)
-    {
-        await ArrangeAuthenticatedAdmin();
-        await _client.PostAsJsonAsync(url, resource);
-
-        // Log out.
-        _client.DefaultRequestHeaders.Authorization = null;
-    }
-
-    private async Task ArrangeAuthenticatedAdmin()
-    {
-        var userInfo = new User() { Name = "admin", Password = Environment.GetEnvironmentVariable(ConfigurationKeys.AdminPassword) ?? string.Empty, };
-        HttpResponseMessage authResponseMessage = await _client.PostAsJsonAsync("/api/v1/users/authenticate", userInfo);
-        AuthenticateResponse? authResponse =
-            await authResponseMessage.Content.ReadFromJsonAsync<AuthenticateResponse>();
-        _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", authResponse?.Token);
-    }
-
-    private async Task ArrangeAuthenticatedUser()
-    {
-        // Arrange - authenticate as admin user.
-        await ArrangeAuthenticatedAdmin();
-
-        // Arrange - create normal user.
-        var user = new User();
-        await _client.PostAsJsonAsync("/api/v1/users", user);
-
-        // Arrange - authenticate as normal user.
-        HttpResponseMessage authResponseMessage =
-            await _client.PostAsJsonAsync("/api/v1/users/authenticate", user);
-        AuthenticateResponse? authResponse =
-            await authResponseMessage.Content.ReadFromJsonAsync<AuthenticateResponse>();
-
-        // Swap out the admin token for a normal user token.
-        _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", authResponse?.Token);
-    }
 }
diff --git a/tests/Server.Tests.Integration/Contracts/ContractApiIntegrationTests.cs b/tests/Server.Tests.Integration/Contracts/ContractApiIntegrationTests.cs
new file mode 100644
index 00000000..9a687482
--- /dev/null
+++ b/tests/Server.Tests.Integration/Contracts/ContractApiIntegrationTests.cs
@@ -0,0 +1,50 @@
+using System.Net.Http;
+using System.Net.Http.Json;
+using System.Threading.Tasks;
+
+using Domain.Contracts;
+
+namespace Server.IntegrationTests.Contracts;
+
+public class ContractApiIntegrationTests : IntegrationTest
+{
+    public ContractApiIntegrationTests(TestWebApplicationFactory factory)
+        : base(factory)
+    {
+    }
+
+    [Fact]
+    public async Task PutContract_CreatesNewContract_WhenItDoesNotExist()
+    {
+        // Arrange
+        await ArrangeAuthenticatedAdminAsync();
+        var newContract = new Contract();
+
+        // Act
+        HttpResponseMessage response = await Client.PutAsJsonAsync($"api/v1/contracts/{newContract.Id}", newContract);
+
+        // Assert
+        response.Should().BeSuccessful();
+        var contracts = await Client.GetFromJsonAsync<IEnumerable<Contract>>("api/v1/contracts");
+        contracts.Should().ContainEquivalentOf(newContract);
+    }
+
+    [Fact]
+    public async Task PutContract_UpdatesExistingContract_WhenItExists()
+    {
+        // Arrange
+        var contract = new Contract();
+        string endpointUrl = $"api/v1/contracts/{contract.Id}";
+        await PutResourceAsync(endpointUrl, contract);
+        await ArrangeAuthenticatedAdminAsync();
+        contract.Name = "Modified name";
+
+        // Act
+        HttpResponseMessage response = await Client.PutAsJsonAsync(endpointUrl, contract);
+
+        // Assert
+        response.Should().BeSuccessful();
+        var contracts = await Client.GetFromJsonAsync<IEnumerable<Contract>>("api/v1/contracts");
+        contracts.Should().ContainEquivalentOf(contract);
+    }
+}
diff --git a/tests/Server.Tests.Integration/IntegrationTest.cs b/tests/Server.Tests.Integration/IntegrationTest.cs
new file mode 100644
index 00000000..cf2ab3be
--- /dev/null
+++ b/tests/Server.Tests.Integration/IntegrationTest.cs
@@ -0,0 +1,76 @@
+using System.Net.Http;
+using System.Net.Http.Headers;
+using System.Net.Http.Json;
+using System.Threading.Tasks;
+
+using Application.Configuration;
+using Application.Users;
+
+using Domain.Users;
+
+namespace Server.IntegrationTests;
+
+public class IntegrationTest : IClassFixture<TestWebApplicationFactory>
+{
+    public IntegrationTest(TestWebApplicationFactory factory)
+    {
+        Client = factory.CreateClient();
+
+        Environment.SetEnvironmentVariable(
+            ConfigurationKeys.AdminPassword,
+            "test_password",
+            EnvironmentVariableTarget.Process);
+    }
+
+    protected HttpClient Client { get; }
+
+    protected async Task PostResourceAsync<TResource>(string url, TResource resource)
+    {
+        await ArrangeAuthenticatedAdminAsync();
+        await Client.PostAsJsonAsync(url, resource);
+
+        // Log out.
+        Client.DefaultRequestHeaders.Authorization = null;
+    }
+
+    protected async Task PutResourceAsync<TResource>(string url, TResource resource)
+    {
+        await ArrangeAuthenticatedAdminAsync();
+        await Client.PutAsJsonAsync(url, resource);
+
+        // Log out.
+        Client.DefaultRequestHeaders.Authorization = null;
+    }
+
+    protected async Task ArrangeAuthenticatedAdminAsync()
+    {
+        var userInfo = new User()
+        {
+            Name = "admin",
+            Password = Environment.GetEnvironmentVariable(ConfigurationKeys.AdminPassword) ?? string.Empty,
+        };
+        HttpResponseMessage authResponseMessage = await Client.PostAsJsonAsync("/api/v1/users/authenticate", userInfo);
+        AuthenticateResponse? authResponse =
+            await authResponseMessage.Content.ReadFromJsonAsync<AuthenticateResponse>();
+        Client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", authResponse?.Token);
+    }
+
+    protected async Task ArrangeAuthenticatedUserAsync()
+    {
+        // Arrange - authenticate as admin user.
+        await ArrangeAuthenticatedAdminAsync();
+
+        // Arrange - create normal user.
+        var user = new User();
+        await Client.PostAsJsonAsync("/api/v1/users", user);
+
+        // Arrange - authenticate as normal user.
+        HttpResponseMessage authResponseMessage =
+            await Client.PostAsJsonAsync("/api/v1/users/authenticate", user);
+        AuthenticateResponse? authResponse =
+            await authResponseMessage.Content.ReadFromJsonAsync<AuthenticateResponse>();
+
+        // Swap out the admin token for a normal user token.
+        Client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", authResponse?.Token);
+    }
+}