Nobody stumbled upon this one? This was isn't working the way I expect it to work.. var user = securityAccessor.BackOfficeSecurity?.CurrentUser; if (user is null) return Unauthorized(); When just logged in in umbraco it works.. but after af while certain cookies are gone I guess, while still logged in in Umbraco and CurrentUser is null.