From 64276f1bdef6c7427568c1353b894f77ea08701b Mon Sep 17 00:00:00 2001
From: Duncan McClean <duncan@duncanmcclean.com>
Date: Wed, 1 Apr 2026 15:17:54 +0100
Subject: [PATCH 1/4] wip

---
 config/users.php                              |   2 +
 resources/js/pages/auth/ConfirmPassword.vue   |  11 +-
 routes/web.php                                |   7 +
 src/Auth/UserTags.php                         |  49 ++++
 .../ElevatedSessionAuthorizationException.php |  13 +-
 .../Auth/ElevatedSessionController.php        | 157 +++++++++++
 .../CP/Auth/ElevatedSessionController.php     |  96 ++-----
 .../Middleware/CP/RequireElevatedSession.php  |  14 +-
 .../Middleware/RequireElevatedSession.php     |  18 ++
 .../ElevatedSessionConfirmationRequest.php    |   2 +-
 src/Providers/AppServiceProvider.php          |  50 ++++
 src/Providers/CpServiceProvider.php           |  51 ----
 tests/Auth/ElevatedSessionTest.php            | 169 ++++++++++-
 tests/Tags/User/ElevatedSessionFormTest.php   | 262 ++++++++++++++++++
 14 files changed, 750 insertions(+), 151 deletions(-)
 create mode 100644 src/Http/Controllers/Auth/ElevatedSessionController.php
 create mode 100644 src/Http/Middleware/RequireElevatedSession.php
 rename src/Http/Requests/{CP => }/Auth/ElevatedSessionConfirmationRequest.php (95%)
 create mode 100644 tests/Tags/User/ElevatedSessionFormTest.php

diff --git a/config/users.php b/config/users.php
index 70e266eb280..e679698c2f4 100644
--- a/config/users.php
+++ b/config/users.php
@@ -181,6 +181,8 @@
 
     'elevated_session_duration' => 15,
 
+    'elevated_session_page' => null,
+
     /*
     |--------------------------------------------------------------------------
     | Two-Factor Authentication
diff --git a/resources/js/pages/auth/ConfirmPassword.vue b/resources/js/pages/auth/ConfirmPassword.vue
index 581daff9b48..86d0c7b3b4c 100644
--- a/resources/js/pages/auth/ConfirmPassword.vue
+++ b/resources/js/pages/auth/ConfirmPassword.vue
@@ -1,3 +1,12 @@
+<script>
+import Outside from '@/pages/layout/Outside.vue';
+import Layout from '@/pages/layout/Layout.vue';
+
+export default {
+    layout: (h, page) => page.props.outside ? h(Outside, () => page) : h(Layout, () => page),
+};
+</script>
+
 <script setup>
 import Head from '@/pages/layout/Head.vue';
 import { AuthCard, Input, Field, Button, Description, ErrorMessage, Separator } from '@ui';
@@ -5,7 +14,7 @@ import { computed } from 'vue';
 import { Form, router } from '@inertiajs/vue3';
 import { usePasskey } from '@/composables/passkey';
 
-const props = defineProps(['method', 'allowPasskey', 'status', 'submitUrl', 'resendUrl', 'passkeyOptionsUrl']);
+const props = defineProps(['method', 'allowPasskey', 'status', 'submitUrl', 'resendUrl', 'passkeyOptionsUrl', 'outside']);
 const isConfirmingPassword = computed(() => props.method === 'password_confirmation');
 const isUsingVerificationCode = computed(() => props.method === 'verification_code');
 const isOnlyUsingPasskey = computed(() => props.method === 'passkey');
diff --git a/routes/web.php b/routes/web.php
index 220088c94e8..f55c748f4f0 100755
--- a/routes/web.php
+++ b/routes/web.php
@@ -21,6 +21,7 @@
 use Statamic\Http\Controllers\User\RegisterController;
 use Statamic\Http\Controllers\User\TwoFactorAuthenticationController;
 use Statamic\Http\Controllers\User\TwoFactorRecoveryCodesController;
+use Statamic\Http\Controllers\Auth\ElevatedSessionController;
 use Statamic\Http\Middleware\AuthGuard;
 use Statamic\Http\Middleware\CP\AuthGuard as CPAuthGuard;
 use Statamic\Http\Middleware\CP\HandleInertiaRequests;
@@ -51,6 +52,12 @@
             Route::get('password/reset/{token}', [ResetPasswordController::class, 'showResetForm'])->name('password.reset');
             Route::post('password/reset', [ResetPasswordController::class, 'reset'])->name('password.reset.action');
 
+            Route::middleware('auth')->group(function () {
+                Route::get('elevated-session', [ElevatedSessionController::class, 'showForm'])->name('elevated-session')->middleware([HandleInertiaRequests::class]);
+                Route::post('elevated-session', [ElevatedSessionController::class, 'confirm'])->name('elevated-session.confirm');
+                Route::get('elevated-session/resend-code', [ElevatedSessionController::class, 'resendCode'])->name('elevated-session.resend-code')->middleware('throttle:send-elevated-session-code');
+            });
+
             if (TwoFactor::enabled()) {
                 Route::get('two-factor-setup', TwoFactorSetupController::class)->name('two-factor-setup');
                 Route::get('two-factor-challenge', [TwoFactorChallengeController::class, 'index'])->name('two-factor-challenge');
diff --git a/src/Auth/UserTags.php b/src/Auth/UserTags.php
index 530180f9fba..85e94cc94fa 100644
--- a/src/Auth/UserTags.php
+++ b/src/Auth/UserTags.php
@@ -629,6 +629,55 @@ public function notIn()
         return $in ? null : $this->parse();
     }
 
+    /**
+     * Output an elevated session form.
+     *
+     * Maps to {{ user:elevated_session_form }}
+     *
+     * @return string
+     */
+    public function elevatedSessionForm()
+    {
+        if (! ($user = User::current())) {
+            return;
+        }
+
+        $method = $user->getElevatedSessionMethod();
+
+        if ($method === 'passkey') {
+            // TODO: Implement frontend passkey support for elevated sessions
+            throw new \Exception('Passkey authentication for elevated sessions is not yet supported on the frontend.');
+        }
+
+        if ($method === 'verification_code') {
+            session()->sendElevatedSessionVerificationCodeIfRequired();
+        }
+
+        $data = [
+            ...$this->getFormSession('user.elevated_session'),
+            'method' => $method,
+            'resend_code_url' => route('statamic.elevated-session.resend-code'),
+        ];
+
+        $action = route('statamic.elevated-session.confirm');
+        $method = 'POST';
+
+        if (! $this->canParseContents()) {
+            return array_merge([
+                'attrs' => $this->formAttrs($action, $method),
+                'params' => $this->formMetaPrefix($this->formParams($method)),
+            ], $data);
+        }
+
+        $html = $this->formOpen($action, $method);
+
+        $html .= $this->parse($data);
+
+        $html .= $this->formClose();
+
+        return $html;
+    }
+
     /**
      * {@inheritdoc}
      */
diff --git a/src/Exceptions/ElevatedSessionAuthorizationException.php b/src/Exceptions/ElevatedSessionAuthorizationException.php
index 477fc5c7aec..1ff335b6310 100644
--- a/src/Exceptions/ElevatedSessionAuthorizationException.php
+++ b/src/Exceptions/ElevatedSessionAuthorizationException.php
@@ -3,6 +3,7 @@
 namespace Statamic\Exceptions;
 
 use Illuminate\Http\Request;
+use Statamic\Statamic;
 
 class ElevatedSessionAuthorizationException extends \Exception
 {
@@ -13,8 +14,14 @@ public function __construct()
 
     public function render(Request $request)
     {
-        return $request->wantsJson()
-            ? response()->json(['message' => $this->getMessage()], 403)
-            : redirect()->setIntendedUrl($request->fullUrl())->to(cp_route('confirm-password'));
+        if ($request->wantsJson()) {
+            return response()->json(['message' => $this->getMessage()], 403);
+        }
+
+        $redirectUrl = Statamic::isCpRoute()
+            ? cp_route('confirm-password')
+            : route('statamic.elevated-session');
+
+        return redirect()->setIntendedUrl($request->fullUrl())->to($redirectUrl);
     }
 }
diff --git a/src/Http/Controllers/Auth/ElevatedSessionController.php b/src/Http/Controllers/Auth/ElevatedSessionController.php
new file mode 100644
index 00000000000..f90c92a7138
--- /dev/null
+++ b/src/Http/Controllers/Auth/ElevatedSessionController.php
@@ -0,0 +1,157 @@
+<?php
+
+namespace Statamic\Http\Controllers\Auth;
+
+use Illuminate\Http\Exceptions\HttpResponseException;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\ValidationException;
+use Inertia\Inertia;
+use Statamic\Auth\WebAuthn\Serializer;
+use Statamic\Facades\User;
+use Statamic\Facades\WebAuthn;
+use Statamic\Http\Controllers\Controller;
+use Statamic\Http\Requests\Auth\ElevatedSessionConfirmationRequest;
+
+class ElevatedSessionController extends Controller
+{
+    public function showForm(Request $request)
+    {
+        $user = User::current();
+        $method = $user->getElevatedSessionMethod();
+
+        if ($customUrl = config('statamic.users.elevated_session_page')) {
+            return redirect()->setIntendedUrl($request->fullUrl())->to($customUrl);
+        }
+
+        if ($method === 'passkey') {
+            // TODO: Implement frontend passkey support for elevated sessions
+            throw new \Exception('Passkey authentication for elevated sessions is not yet supported on the frontend.');
+        }
+
+        if ($method === 'verification_code') {
+            session()->sendElevatedSessionVerificationCodeIfRequired();
+        }
+
+        return Inertia::render('auth/ConfirmPassword', [
+            'outside' => true,
+            'method' => $method,
+            'allowPasskey' => false,
+            'status' => session('status'),
+            'submitUrl' => route('statamic.elevated-session.confirm'),
+            'resendUrl' => route('statamic.elevated-session.resend-code'),
+        ]);
+    }
+
+    public function confirm(ElevatedSessionConfirmationRequest $request)
+    {
+        $user = User::current();
+
+        $this->validatePasswordConfirmation($request, $user);
+        $this->validateVerificationCodeConfirmation($request);
+        $this->validatePasskeyConfirmation($request, $user);
+
+        session()->elevate();
+
+        return $this->buildConfirmResponse($request, $user);
+    }
+
+    protected function buildConfirmResponse(Request $request, $user)
+    {
+        $message = $user->getElevatedSessionMethod() === 'password_confirmation'
+            ? __('Password confirmed')
+            : __('Code verified');
+
+        $redirect = redirect()->intended(route('statamic.site'));
+
+        if ($request->wantsJson()) {
+            return response()->json([
+                'elevated' => true,
+                'expiry' => $request->getElevatedSessionExpiry(),
+                'redirect' => $redirect->getTargetUrl(),
+            ]);
+        }
+
+        return $request->inertia()
+            ? Inertia::location($redirect->getTargetUrl())
+            : $redirect->with('success', $message);
+    }
+
+    public function options()
+    {
+        $options = WebAuthn::prepareAssertion();
+
+        return app(Serializer::class)->normalize($options);
+    }
+
+    public function resendCode()
+    {
+        if (User::current()->getElevatedSessionMethod() !== 'verification_code') {
+            throw ValidationException::withMessages([
+                'method' => 'Resend code is only available for verification code method',
+            ]);
+        }
+
+        session()->sendElevatedSessionVerificationCode();
+
+        return back()->with('success', __('statamic::messages.elevated_session_verification_code_sent'));
+    }
+
+    private function validatePasswordConfirmation(Request $request, $user): void
+    {
+        if (! $request->filled('password')) {
+            return;
+        }
+
+        if (Hash::check($request->password, $user->password())) {
+            return;
+        }
+
+        $this->throwValidationException($request, [
+            'password' => [__('statamic::validation.current_password')],
+        ]);
+    }
+
+    private function validateVerificationCodeConfirmation(Request $request): void
+    {
+        if (! $request->filled('verification_code')) {
+            return;
+        }
+
+        $verificationCode = $request->verification_code;
+        $storedVerificationCode = $request->getElevatedSessionVerificationCode();
+
+        if (
+            is_string($verificationCode)
+            && is_string($storedVerificationCode)
+            && hash_equals($storedVerificationCode, $verificationCode)
+        ) {
+            return;
+        }
+
+        $this->throwValidationException($request, [
+            'verification_code' => [__('statamic::validation.elevated_session_verification_code')],
+        ]);
+    }
+
+    protected function throwValidationException(Request $request, array $errors): never
+    {
+        if ($request->wantsJson()) {
+            throw ValidationException::withMessages($errors);
+        }
+
+        throw new HttpResponseException(
+            back()->withInput()->withErrors($errors, 'user.elevated_session')
+        );
+    }
+
+    private function validatePasskeyConfirmation(Request $request, $user): void
+    {
+        if (! $request->filled('id')) {
+            return;
+        }
+
+        $credentials = $request->only(['id', 'rawId', 'response', 'type']);
+        WebAuthn::validateAssertion($user, $credentials);
+    }
+}
diff --git a/src/Http/Controllers/CP/Auth/ElevatedSessionController.php b/src/Http/Controllers/CP/Auth/ElevatedSessionController.php
index 44e0705028c..dda9fc35f38 100644
--- a/src/Http/Controllers/CP/Auth/ElevatedSessionController.php
+++ b/src/Http/Controllers/CP/Auth/ElevatedSessionController.php
@@ -3,15 +3,12 @@
 namespace Statamic\Http\Controllers\CP\Auth;
 
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Hash;
 use Illuminate\Validation\ValidationException;
 use Inertia\Inertia;
-use Statamic\Auth\WebAuthn\Serializer;
 use Statamic\Facades\User;
-use Statamic\Facades\WebAuthn;
-use Statamic\Http\Requests\CP\Auth\ElevatedSessionConfirmationRequest;
+use Statamic\Http\Controllers\Auth\ElevatedSessionController as BaseController;
 
-class ElevatedSessionController
+class ElevatedSessionController extends BaseController
 {
     public function status(Request $request)
     {
@@ -30,14 +27,7 @@ public function status(Request $request)
         return $response;
     }
 
-    public function options()
-    {
-        $options = WebAuthn::prepareAssertion();
-
-        return app(Serializer::class)->normalize($options);
-    }
-
-    public function showForm()
+    public function showForm(Request $request)
     {
         $user = User::current();
 
@@ -46,6 +36,7 @@ public function showForm()
         }
 
         return Inertia::render('auth/ConfirmPassword', [
+            'outside' => false,
             'method' => $method,
             'status' => session('status'),
             'allowPasskey' => $method !== 'verification_code' && $user->passkeys()->isNotEmpty(),
@@ -55,78 +46,27 @@ public function showForm()
         ]);
     }
 
-    public function confirm(ElevatedSessionConfirmationRequest $request)
+    protected function buildConfirmResponse(Request $request, $user)
     {
-        $user = User::current();
-
-        $this->validatePasswordConfirmation($request, $user);
-        $this->validateVerificationCodeConfirmation($request);
-        $this->validatePasskeyConfirmation($request, $user);
-
-        session()->elevate();
-
         $redirect = redirect()->intended(cp_route('index'));
 
-        return $request->wantsJson()
-            ? array_merge($this->status($request), ['redirect' => $redirect->getTargetUrl()])
-            : $redirect->with('success', $user->getElevatedSessionMethod() === 'password_confirmation' ? __('Password confirmed') : __('Code verified'));
-    }
-
-    private function validatePasswordConfirmation(Request $request, $user): void
-    {
-        if (! $request->filled('password')) {
-            return;
-        }
-
-        if (Hash::check($request->password, $user->password())) {
-            return;
+        if ($request->wantsJson()) {
+            return array_merge(
+                $this->status($request),
+                ['redirect' => $redirect->getTargetUrl()]
+            );
         }
 
-        throw ValidationException::withMessages([
-            'password' => [__('statamic::validation.current_password')],
-        ]);
+        return $redirect->with(
+            'success',
+            $user->getElevatedSessionMethod() === 'password_confirmation'
+                ? __('Password confirmed')
+                : __('Code verified')
+        );
     }
 
-    private function validateVerificationCodeConfirmation(Request $request): void
+    protected function throwValidationException(Request $request, array $errors): never
     {
-        if (! $request->filled('verification_code')) {
-            return;
-        }
-
-        $verificationCode = $request->verification_code;
-        $storedVerificationCode = $request->getElevatedSessionVerificationCode();
-
-        if (
-            is_string($verificationCode)
-            && is_string($storedVerificationCode)
-            && hash_equals($storedVerificationCode, $verificationCode)
-        ) {
-            return;
-        }
-
-        throw ValidationException::withMessages([
-            'verification_code' => [__('statamic::validation.elevated_session_verification_code')],
-        ]);
-    }
-
-    private function validatePasskeyConfirmation(Request $request, $user): void
-    {
-        if (! $request->filled('id')) {
-            return;
-        }
-
-        $credentials = $request->only(['id', 'rawId', 'response', 'type']);
-        WebAuthn::validateAssertion($user, $credentials);
-    }
-
-    public function resendCode()
-    {
-        if (User::current()->getElevatedSessionMethod() !== 'verification_code') {
-            throw ValidationException::withMessages(['method' => 'Resend code is only available for verification code method']);
-        }
-
-        session()->sendElevatedSessionVerificationCode();
-
-        return back()->with('success', __('statamic::messages.elevated_session_verification_code_sent'));
+        throw ValidationException::withMessages($errors);
     }
 }
diff --git a/src/Http/Middleware/CP/RequireElevatedSession.php b/src/Http/Middleware/CP/RequireElevatedSession.php
index cf493393a8a..1b76436705c 100644
--- a/src/Http/Middleware/CP/RequireElevatedSession.php
+++ b/src/Http/Middleware/CP/RequireElevatedSession.php
@@ -2,17 +2,9 @@
 
 namespace Statamic\Http\Middleware\CP;
 
-use Closure;
-use Statamic\Exceptions\ElevatedSessionAuthorizationException;
+use Statamic\Http\Middleware\RequireElevatedSession as Middleware;
 
-class RequireElevatedSession
+class RequireElevatedSession extends Middleware
 {
-    public function handle($request, Closure $next)
-    {
-        if (! $request->hasElevatedSession()) {
-            throw new ElevatedSessionAuthorizationException;
-        }
-
-        return $next($request);
-    }
+    //
 }
diff --git a/src/Http/Middleware/RequireElevatedSession.php b/src/Http/Middleware/RequireElevatedSession.php
new file mode 100644
index 00000000000..773a14255a7
--- /dev/null
+++ b/src/Http/Middleware/RequireElevatedSession.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace Statamic\Http\Middleware;
+
+use Closure;
+use Statamic\Exceptions\ElevatedSessionAuthorizationException;
+
+class RequireElevatedSession
+{
+    public function handle($request, Closure $next)
+    {
+        if (! $request->hasElevatedSession()) {
+            throw new ElevatedSessionAuthorizationException;
+        }
+
+        return $next($request);
+    }
+}
diff --git a/src/Http/Requests/CP/Auth/ElevatedSessionConfirmationRequest.php b/src/Http/Requests/Auth/ElevatedSessionConfirmationRequest.php
similarity index 95%
rename from src/Http/Requests/CP/Auth/ElevatedSessionConfirmationRequest.php
rename to src/Http/Requests/Auth/ElevatedSessionConfirmationRequest.php
index dd217a9bdc7..19b2ad8b546 100644
--- a/src/Http/Requests/CP/Auth/ElevatedSessionConfirmationRequest.php
+++ b/src/Http/Requests/Auth/ElevatedSessionConfirmationRequest.php
@@ -1,6 +1,6 @@
 <?php
 
-namespace Statamic\Http\Requests\CP\Auth;
+namespace Statamic\Http\Requests\Auth;
 
 use Illuminate\Foundation\Http\FormRequest;
 
diff --git a/src/Providers/AppServiceProvider.php b/src/Providers/AppServiceProvider.php
index a58cfbdf1cc..2fed000779b 100644
--- a/src/Providers/AppServiceProvider.php
+++ b/src/Providers/AppServiceProvider.php
@@ -8,13 +8,17 @@
 use Illuminate\Foundation\Http\Middleware\TrimStrings;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Router;
+use Illuminate\Support\Facades\Session;
 use Illuminate\Support\ServiceProvider;
+use Illuminate\Support\Str;
 use Statamic\CP\CarbonAsVueComponent;
 use Statamic\Facades;
 use Statamic\Facades\Addon;
 use Statamic\Facades\Site;
 use Statamic\Facades\Stache;
 use Statamic\Facades\Token;
+use Statamic\Facades\User;
+use Statamic\Notifications\ElevatedSessionVerificationCode;
 use Statamic\Fields\FieldsetRecursionStack;
 use Statamic\Jobs\HandleEntrySchedule;
 use Statamic\Sites\Sites;
@@ -123,6 +127,8 @@ public function boot()
 
         $this->addAboutCommandInfo();
 
+        $this->registerElevatedSessionMacros();
+
         $this->app->make(Schedule::class)->job(HandleEntrySchedule::class)->everyMinute();
     }
 
@@ -292,4 +298,48 @@ private function sitesAboutCommandInfo()
 
         return $sites->count().' ('.$summary.')';
     }
+
+    private function registerElevatedSessionMacros()
+    {
+        Request::macro('hasElevatedSession', function () {
+            return $this->getElevatedSessionExpiry() > now()->timestamp;
+        });
+
+        Request::macro('getElevatedSessionExpiry', function () {
+            if (! $lastElevated = session()->get('statamic_elevated_session')) {
+                return null;
+            }
+
+            return Carbon::createFromTimestamp($lastElevated)
+                ->addMinutes(config('statamic.users.elevated_session_duration', 15))
+                ->timestamp;
+        });
+
+        Request::macro('getElevatedSessionVerificationCode', function () {
+            return session()->get('statamic_elevated_session_verification_code')['code'] ?? null;
+        });
+
+        Session::macro('elevate', function () {
+            $this->put('statamic_elevated_session', now()->timestamp);
+        });
+
+        Session::macro('sendElevatedSessionVerificationCodeIfRequired', function () {
+            if ($timestamp = session()->get('statamic_elevated_session_verification_code')['generated_at'] ?? null) {
+                if ($timestamp > now()->subMinutes(5)->timestamp) {
+                    return;
+                }
+            }
+
+            $this->sendElevatedSessionVerificationCode();
+        });
+
+        Session::macro('sendElevatedSessionVerificationCode', function () {
+            session()->put(
+                key: 'statamic_elevated_session_verification_code',
+                value: ['code' => $verificationCode = Str::random(20), 'generated_at' => now()->timestamp],
+            );
+
+            User::current()->notify(new ElevatedSessionVerificationCode($verificationCode));
+        });
+    }
 }
diff --git a/src/Providers/CpServiceProvider.php b/src/Providers/CpServiceProvider.php
index f9956faddef..1337a22fe2b 100644
--- a/src/Providers/CpServiceProvider.php
+++ b/src/Providers/CpServiceProvider.php
@@ -2,14 +2,10 @@
 
 namespace Statamic\Providers;
 
-use Illuminate\Http\Request;
 use Illuminate\Routing\Router;
-use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Blade;
-use Illuminate\Support\Facades\Session;
 use Illuminate\Support\Facades\View;
 use Illuminate\Support\ServiceProvider;
-use Illuminate\Support\Str;
 use Inertia\Inertia;
 use Statamic\CP\Utilities\UtilityRepository;
 use Statamic\Extensions\Translation\Loader;
@@ -19,7 +15,6 @@
 use Statamic\Http\View\Composers\JavascriptComposer;
 use Statamic\Licensing\LicenseManager;
 use Statamic\Licensing\Outpost;
-use Statamic\Notifications\ElevatedSessionVerificationCode;
 use Statamic\View\Components\OutsideLogo;
 
 class CpServiceProvider extends ServiceProvider
@@ -46,8 +41,6 @@ public function boot()
 
         $this->registerMiddlewareGroups();
 
-        $this->registerElevatedSessionMacros();
-
         $this->bootSelfClosingUiTags();
     }
 
@@ -113,50 +106,6 @@ protected function registerMiddlewareGroups()
         ]);
     }
 
-    private function registerElevatedSessionMacros()
-    {
-        Request::macro('hasElevatedSession', function () {
-            return $this->getElevatedSessionExpiry() > now()->timestamp;
-        });
-
-        Request::macro('getElevatedSessionExpiry', function () {
-            if (! $lastElevated = session()->get('statamic_elevated_session')) {
-                return null;
-            }
-
-            return Carbon::createFromTimestamp($lastElevated)
-                ->addMinutes(config('statamic.users.elevated_session_duration', 15))
-                ->timestamp;
-        });
-
-        Request::macro('getElevatedSessionVerificationCode', function () {
-            return session()->get('statamic_elevated_session_verification_code')['code'] ?? null;
-        });
-
-        Session::macro('elevate', function () {
-            $this->put('statamic_elevated_session', now()->timestamp);
-        });
-
-        Session::macro('sendElevatedSessionVerificationCodeIfRequired', function () {
-            if ($timestamp = session()->get('statamic_elevated_session_verification_code')['generated_at'] ?? null) {
-                if ($timestamp > now()->subMinutes(5)->timestamp) {
-                    return;
-                }
-            }
-
-            $this->sendElevatedSessionVerificationCode();
-        });
-
-        Session::macro('sendElevatedSessionVerificationCode', function () {
-            session()->put(
-                key: 'statamic_elevated_session_verification_code',
-                value: ['code' => $verificationCode = Str::random(20), 'generated_at' => now()->timestamp],
-            );
-
-            User::current()->notify(new ElevatedSessionVerificationCode($verificationCode));
-        });
-    }
-
     private function bootSelfClosingUiTags()
     {
         // Converts <ui-component /> to <ui-component></ui-component>
diff --git a/tests/Auth/ElevatedSessionTest.php b/tests/Auth/ElevatedSessionTest.php
index 242670a63df..aba4f058c63 100644
--- a/tests/Auth/ElevatedSessionTest.php
+++ b/tests/Auth/ElevatedSessionTest.php
@@ -12,7 +12,7 @@
 use Statamic\Contracts\Auth\Passkey;
 use Statamic\Facades\User;
 use Statamic\Facades\WebAuthn;
-use Statamic\Http\Middleware\CP\RequireElevatedSession;
+use Statamic\Http\Middleware;
 use Statamic\Notifications\ElevatedSessionVerificationCode;
 use Tests\ElevatesSessions;
 use Tests\PreventSavingStacheItemsToDisk;
@@ -43,7 +43,11 @@ protected function resolveApplicationConfiguration($app)
         $app->booted(function () {
             Route::get('/requires-elevated-session', function () {
                 return 'ok';
-            })->middleware(RequireElevatedSession::class);
+            })->middleware(Middleware\RequireElevatedSession::class);
+
+            Route::get('/cp/requires-elevated-session', function () {
+                return 'ok';
+            })->middleware(Middleware\CP\RequireElevatedSession::class);
         });
     }
 
@@ -272,7 +276,7 @@ public function middleware_allows_request()
 
         $this
             ->withElevatedSession()
-            ->get('/requires-elevated-session')
+            ->get('/cp/requires-elevated-session')
             ->assertOk()
             ->assertSee('ok');
     }
@@ -284,7 +288,7 @@ public function middleware_denies_request_when_elevated_session_has_expired()
 
         $this
             ->withElevatedSession(now()->subMinutes(16))
-            ->get('/requires-elevated-session')
+            ->get('/cp/requires-elevated-session')
             ->assertRedirect('/cp/auth/confirm-password');
     }
 
@@ -295,7 +299,7 @@ public function middleware_denies_request_when_elevated_session_has_expired_via_
 
         $this
             ->withElevatedSession(now()->subMinutes(16))
-            ->getJson('/requires-elevated-session')
+            ->getJson('/cp/requires-elevated-session')
             ->assertStatus(403)
             ->assertJson(['message' => __('Requires an elevated session.')]);
     }
@@ -311,7 +315,7 @@ public function the_session_is_elevated_upon_login()
             ->assertRedirectToRoute('statamic.cp.index');
 
         $this
-            ->get('/requires-elevated-session')
+            ->get('/cp/requires-elevated-session')
             ->assertOk();
     }
 
@@ -569,4 +573,157 @@ public function status_endpoint_returns_passkey_method()
                 'method' => 'passkey',
             ]);
     }
+
+    #[Test]
+    public function frontend_middleware_allows_request()
+    {
+        $this->actingAs($this->user);
+
+        $this
+            ->withElevatedSession()
+            ->get('/requires-elevated-session')
+            ->assertOk()
+            ->assertSee('ok');
+    }
+
+    #[Test]
+    public function frontend_middleware_denies_request_when_elevated_session_has_expired()
+    {
+        $this->actingAs($this->user);
+
+        $this
+            ->withElevatedSession(now()->subMinutes(16))
+            ->get('/requires-elevated-session')
+            ->assertRedirect('/!/auth/elevated-session');
+    }
+
+    #[Test]
+    public function frontend_middleware_denies_request_when_elevated_session_has_expired_via_json()
+    {
+        $this->actingAs($this->user);
+
+        $this
+            ->withElevatedSession(now()->subMinutes(16))
+            ->getJson('/requires-elevated-session')
+            ->assertStatus(403)
+            ->assertJson(['message' => __('Requires an elevated session.')]);
+    }
+
+    #[Test]
+    public function frontend_elevated_session_redirects_to_custom_url_when_configured()
+    {
+        config(['statamic.users.elevated_session_page' => '/custom-elevated-session']);
+
+        $this
+            ->actingAs($this->user)
+            ->get('/!/auth/elevated-session')
+            ->assertRedirect('/custom-elevated-session');
+    }
+
+    #[Test]
+    public function frontend_elevated_session_shows_inertia_page_when_no_custom_url()
+    {
+        config(['statamic.users.elevated_session_page' => null]);
+
+        $this
+            ->actingAs($this->user)
+            ->get('/!/auth/elevated-session')
+            ->assertInertia(fn ($page) => $page
+                ->component('auth/ConfirmPassword')
+                ->where('outside', true)
+                ->has('method')
+                ->has('submitUrl')
+                ->has('resendUrl')
+            );
+    }
+
+    #[Test]
+    public function frontend_can_confirm_elevated_session_with_password()
+    {
+        redirect()->setIntendedUrl('/target-url');
+
+        $this
+            ->actingAs($this->user)
+            ->post('/!/auth/elevated-session', ['password' => 'secret'])
+            ->assertRedirect('/target-url')
+            ->assertSessionHas('statamic_elevated_session', now()->timestamp);
+    }
+
+    #[Test]
+    public function frontend_can_confirm_elevated_session_via_json()
+    {
+        $this
+            ->actingAs($this->user)
+            ->postJson('/!/auth/elevated-session', ['password' => 'secret'])
+            ->assertOk()
+            ->assertJsonStructure(['elevated', 'expiry', 'redirect'])
+            ->assertSessionHas('statamic_elevated_session', now()->timestamp);
+    }
+
+    #[Test]
+    public function frontend_cannot_confirm_elevated_session_with_incorrect_password()
+    {
+        $this
+            ->actingAs($this->user)
+            ->post('/!/auth/elevated-session', ['password' => 'wrong'])
+            ->assertSessionHasErrors(['password'], null, 'user.elevated_session')
+            ->assertSessionMissing('statamic_elevated_session');
+    }
+
+    #[Test]
+    public function frontend_verification_code_will_be_sent_for_passwordless_user_when_loading_the_form()
+    {
+        Notification::fake();
+        Str::createRandomStringsUsing(fn () => 'abc');
+        config(['statamic.users.elevated_session_page' => null]);
+
+        $this
+            ->actingAs($user = tap(User::make()->email('foo@bar.com')->makeSuper())->save())
+            ->get('/!/auth/elevated-session')
+            ->assertSessionHas('statamic_elevated_session_verification_code', [
+                'code' => 'abc',
+                'generated_at' => now()->timestamp,
+            ]);
+
+        Notification::assertSentTo($user, ElevatedSessionVerificationCode::class, function ($notification) {
+            return $notification->verificationCode === 'abc';
+        });
+    }
+
+    #[Test]
+    public function frontend_verification_code_can_be_resent()
+    {
+        Notification::fake();
+        Str::createRandomStringsUsing(fn () => 'abc');
+
+        $this
+            ->actingAs($user = User::make()->email('foo@bar.com')->makeSuper())
+            ->from('/original')
+            ->get('/!/auth/elevated-session/resend-code')
+            ->assertRedirect('/original')
+            ->assertSessionHas('success')
+            ->assertSessionHas('statamic_elevated_session_verification_code', [
+                'code' => 'abc',
+                'generated_at' => now()->timestamp,
+            ]);
+
+        Notification::assertSentTo($user, ElevatedSessionVerificationCode::class, function ($notification) {
+            return $notification->verificationCode === 'abc';
+        });
+    }
+
+    #[Test]
+    public function the_session_is_elevated_upon_frontend_login()
+    {
+        $this
+            ->post('/!/auth/login', [
+                'email' => 'foo@bar.com',
+                'password' => 'secret',
+            ])
+            ->assertRedirect('/');
+
+        $this
+            ->get('/requires-elevated-session')
+            ->assertOk();
+    }
 }
diff --git a/tests/Tags/User/ElevatedSessionFormTest.php b/tests/Tags/User/ElevatedSessionFormTest.php
new file mode 100644
index 00000000000..55c7e610839
--- /dev/null
+++ b/tests/Tags/User/ElevatedSessionFormTest.php
@@ -0,0 +1,262 @@
+<?php
+
+namespace Tests\Tags\User;
+
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Str;
+use PHPUnit\Framework\Attributes\Group;
+use PHPUnit\Framework\Attributes\Test;
+use Statamic\Auth\File\Passkey;
+use Statamic\Facades\Parse;
+use Statamic\Facades\User;
+use Statamic\Facades\WebAuthn;
+use Statamic\Notifications\ElevatedSessionVerificationCode;
+use Statamic\Statamic;
+use Tests\PreventSavingStacheItemsToDisk;
+use Tests\TestCase;
+use Webauthn\PublicKeyCredentialSource;
+
+#[Group('elevated-session')]
+class ElevatedSessionFormTest extends TestCase
+{
+    use PreventSavingStacheItemsToDisk;
+
+    protected function resolveApplicationConfiguration($app)
+    {
+        parent::resolveApplicationConfiguration($app);
+
+        $app->booted(function () {
+            Route::get('/test-elevated-form', function () {
+                return Parse::template('{{ user:elevated_session_form }}content{{ /user:elevated_session_form }}', trusted: true);
+            });
+        });
+    }
+
+    private function tag($tag)
+    {
+        return Parse::template($tag, trusted: true);
+    }
+
+    #[Test]
+    public function it_renders_form()
+    {
+        $user = User::make()->email('foo@bar.com')->password('secret');
+        $user->save();
+        $this->actingAs($user);
+
+        $output = $this->tag('{{ user:elevated_session_form }}{{ /user:elevated_session_form }}');
+
+        $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/elevated-session">', $output);
+        $this->assertStringContainsString(csrf_field(), $output);
+        $this->assertStringEndsWith('</form>', $output);
+    }
+
+    #[Test]
+    public function it_renders_form_with_params()
+    {
+        $user = User::make()->email('foo@bar.com')->password('secret');
+        $user->save();
+        $this->actingAs($user);
+
+        $output = $this->tag('{{ user:elevated_session_form class="form" id="form" }}{{ /user:elevated_session_form }}');
+
+        $this->assertStringStartsWith('<form method="POST" action="http://localhost/!/auth/elevated-session" class="form" id="form">', $output);
+    }
+
+    #[Test]
+    public function it_provides_method_context()
+    {
+        $user = User::make()->email('foo@bar.com')->password('secret');
+        $user->save();
+        $this->actingAs($user);
+
+        $output = $this->tag('{{ user:elevated_session_form }}<p class="method">{{ method }}</p>{{ /user:elevated_session_form }}');
+
+        preg_match('/<p class="method">(.+)<\/p>/U', $output, $matches);
+        $this->assertEquals('password_confirmation', $matches[1]);
+    }
+
+    #[Test]
+    public function it_provides_verification_code_method_for_passwordless_users()
+    {
+        Notification::fake();
+
+        $user = User::make()->email('foo@bar.com');
+        $user->save();
+        $this->actingAs($user);
+
+        $output = $this->tag('{{ user:elevated_session_form }}<p class="method">{{ method }}</p>{{ /user:elevated_session_form }}');
+
+        preg_match('/<p class="method">(.+)<\/p>/U', $output, $matches);
+        $this->assertEquals('verification_code', $matches[1]);
+    }
+
+    #[Test]
+    public function it_provides_passkey_method_when_passwords_are_disabled()
+    {
+        $this->markTestSkipped('TODO: Passkey support is not yet implemented.');
+
+        config('statamic.webauthn.allow_password_login_with_passkey', false);
+
+        $user = User::make()->email('foo@bar.com');
+
+        $mockCredential = \Mockery::mock(PublicKeyCredentialSource::class);
+        $mockCredential->publicKeyCredentialId = 'key-a';
+
+        $user->setPasskeys(collect([
+            (new Passkey)->setCredential($mockCredential),
+        ]));
+
+        $user->save();
+        $this->actingAs($user);
+
+        $output = $this->tag('{{ user:elevated_session_form }}<p class="method">{{ method }}</p>{{ /user:elevated_session_form }}');
+
+        preg_match('/<p class="method">(.+)<\/p>/U', $output, $matches);
+        $this->assertEquals('passkey', $matches[1]);
+    }
+
+    #[Test]
+    public function it_provides_resend_code_url()
+    {
+        $user = User::make()->email('foo@bar.com')->password('secret');
+        $user->save();
+        $this->actingAs($user);
+
+        $output = $this->tag('{{ user:elevated_session_form }}<a href="{{ resend_code_url }}">Resend</a>{{ /user:elevated_session_form }}');
+
+        $this->assertStringContainsString('href="http://localhost/!/auth/elevated-session/resend-code"', $output);
+    }
+
+    #[Test]
+    public function it_sends_verification_code_when_method_is_verification_code()
+    {
+        Notification::fake();
+        Str::createRandomStringsUsing(fn () => 'abc');
+
+        $user = User::make()->email('foo@bar.com');
+        $user->save();
+        $this->actingAs($user);
+
+        $this->tag('{{ user:elevated_session_form }}{{ /user:elevated_session_form }}');
+
+        Notification::assertSentTo($user, ElevatedSessionVerificationCode::class, function ($notification) {
+            return $notification->verificationCode === 'abc';
+        });
+
+        $this->assertEquals('abc', session()->get('statamic_elevated_session_verification_code')['code']);
+    }
+
+    #[Test]
+    public function it_does_not_render_when_user_not_logged_in()
+    {
+        $output = $this->tag('{{ user:elevated_session_form }}content{{ /user:elevated_session_form }}');
+
+        $this->assertEquals('', $output);
+    }
+
+    #[Test]
+    public function it_fetches_form_data()
+    {
+        $user = User::make()->email('foo@bar.com')->password('secret');
+        $user->save();
+        $this->actingAs($user);
+
+        $form = Statamic::tag('user:elevated_session_form')->fetch();
+
+        $this->assertEquals('http://localhost/!/auth/elevated-session', $form['attrs']['action']);
+        $this->assertEquals('POST', $form['attrs']['method']);
+        $this->assertEquals('password_confirmation', $form['method']);
+        $this->assertArrayHasKey('_token', $form['params']);
+    }
+
+    #[Test]
+    public function it_can_confirm_with_password()
+    {
+        $this->freezeTime();
+
+        $user = User::make()->email('foo@bar.com')->password('secret');
+        $user->save();
+
+        $this
+            ->actingAs($user)
+            ->post('/!/auth/elevated-session', [
+                'password' => 'secret',
+            ])
+            ->assertSessionHas('statamic_elevated_session', now()->timestamp);
+    }
+
+    #[Test]
+    public function it_cannot_confirm_with_incorrect_password()
+    {
+        $user = User::make()->email('foo@bar.com')->password('secret');
+        $user->save();
+
+        $this
+            ->actingAs($user)
+            ->post('/!/auth/elevated-session', [
+                'password' => 'wrong',
+            ])
+            ->assertSessionHasErrors(['password'], null, 'user.elevated_session')
+            ->assertSessionMissing('statamic_elevated_session');
+    }
+
+    #[Test]
+    public function it_can_confirm_with_verification_code()
+    {
+        $this->freezeTime();
+        Notification::fake();
+        Str::createRandomStringsUsing(fn () => 'abc123');
+
+        $user = User::make()->email('foo@bar.com');
+        $user->save();
+
+        $this->actingAs($user);
+        session()->sendElevatedSessionVerificationCode();
+
+        $this
+            ->actingAs($user)
+            ->post('/!/auth/elevated-session', [
+                'verification_code' => 'abc123',
+            ])
+            ->assertSessionHas('statamic_elevated_session', now()->timestamp);
+    }
+
+    #[Test]
+    public function it_cannot_confirm_with_incorrect_verification_code()
+    {
+        Notification::fake();
+        Str::createRandomStringsUsing(fn () => 'abc123');
+
+        $user = User::make()->email('foo@bar.com');
+        $user->save();
+
+        $this->actingAs($user);
+        session()->sendElevatedSessionVerificationCode();
+
+        $this
+            ->actingAs($user)
+            ->post('/!/auth/elevated-session', [
+                'verification_code' => 'wrong',
+            ])
+            ->assertSessionHasErrors(['verification_code'], null, 'user.elevated_session')
+            ->assertSessionMissing('statamic_elevated_session');
+    }
+
+    #[Test]
+    public function it_redirects_to_intended_url_after_confirmation()
+    {
+        $user = User::make()->email('foo@bar.com')->password('secret');
+        $user->save();
+
+        redirect()->setIntendedUrl('/intended-destination');
+
+        $this
+            ->actingAs($user)
+            ->post('/!/auth/elevated-session', [
+                'password' => 'secret',
+            ])
+            ->assertRedirect('/intended-destination');
+    }
+}

From 767598dc2865a9a571025450bfb38b983cab24c8 Mon Sep 17 00:00:00 2001
From: Duncan McClean <duncan@duncanmcclean.com>
Date: Thu, 2 Apr 2026 12:07:05 +0100
Subject: [PATCH 2/4] formatting

---
 routes/web.php                              | 2 +-
 src/Providers/AppServiceProvider.php        | 2 +-
 tests/Tags/User/ElevatedSessionFormTest.php | 1 -
 3 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/routes/web.php b/routes/web.php
index f55c748f4f0..4fba68b9cee 100755
--- a/routes/web.php
+++ b/routes/web.php
@@ -7,6 +7,7 @@
 use Statamic\Facades\OAuth;
 use Statamic\Facades\TwoFactor;
 use Statamic\Http\Controllers\ActivateAccountController;
+use Statamic\Http\Controllers\Auth\ElevatedSessionController;
 use Statamic\Http\Controllers\ForgotPasswordController;
 use Statamic\Http\Controllers\FormController;
 use Statamic\Http\Controllers\FrontendController;
@@ -21,7 +22,6 @@
 use Statamic\Http\Controllers\User\RegisterController;
 use Statamic\Http\Controllers\User\TwoFactorAuthenticationController;
 use Statamic\Http\Controllers\User\TwoFactorRecoveryCodesController;
-use Statamic\Http\Controllers\Auth\ElevatedSessionController;
 use Statamic\Http\Middleware\AuthGuard;
 use Statamic\Http\Middleware\CP\AuthGuard as CPAuthGuard;
 use Statamic\Http\Middleware\CP\HandleInertiaRequests;
diff --git a/src/Providers/AppServiceProvider.php b/src/Providers/AppServiceProvider.php
index 2fed000779b..97a7435df1d 100644
--- a/src/Providers/AppServiceProvider.php
+++ b/src/Providers/AppServiceProvider.php
@@ -18,9 +18,9 @@
 use Statamic\Facades\Stache;
 use Statamic\Facades\Token;
 use Statamic\Facades\User;
-use Statamic\Notifications\ElevatedSessionVerificationCode;
 use Statamic\Fields\FieldsetRecursionStack;
 use Statamic\Jobs\HandleEntrySchedule;
+use Statamic\Notifications\ElevatedSessionVerificationCode;
 use Statamic\Sites\Sites;
 use Statamic\Stache\Query\RevisionQueryBuilder;
 use Statamic\Statamic;
diff --git a/tests/Tags/User/ElevatedSessionFormTest.php b/tests/Tags/User/ElevatedSessionFormTest.php
index 55c7e610839..86e43b99c44 100644
--- a/tests/Tags/User/ElevatedSessionFormTest.php
+++ b/tests/Tags/User/ElevatedSessionFormTest.php
@@ -10,7 +10,6 @@
 use Statamic\Auth\File\Passkey;
 use Statamic\Facades\Parse;
 use Statamic\Facades\User;
-use Statamic\Facades\WebAuthn;
 use Statamic\Notifications\ElevatedSessionVerificationCode;
 use Statamic\Statamic;
 use Tests\PreventSavingStacheItemsToDisk;

From e6247bba0eb5f527bb639ab6956ac6e1284c9dff Mon Sep 17 00:00:00 2001
From: Duncan McClean <duncan@duncanmcclean.com>
Date: Thu, 2 Apr 2026 12:13:30 +0100
Subject: [PATCH 3/4] make it `confirm-password` like the cp

---
 routes/web.php                     | 2 +-
 tests/Auth/ElevatedSessionTest.php | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/routes/web.php b/routes/web.php
index 4fba68b9cee..e97c47c65d8 100755
--- a/routes/web.php
+++ b/routes/web.php
@@ -53,7 +53,7 @@
             Route::post('password/reset', [ResetPasswordController::class, 'reset'])->name('password.reset.action');
 
             Route::middleware('auth')->group(function () {
-                Route::get('elevated-session', [ElevatedSessionController::class, 'showForm'])->name('elevated-session')->middleware([HandleInertiaRequests::class]);
+                Route::get('confirm-password', [ElevatedSessionController::class, 'showForm'])->name('elevated-session')->middleware([HandleInertiaRequests::class]);
                 Route::post('elevated-session', [ElevatedSessionController::class, 'confirm'])->name('elevated-session.confirm');
                 Route::get('elevated-session/resend-code', [ElevatedSessionController::class, 'resendCode'])->name('elevated-session.resend-code')->middleware('throttle:send-elevated-session-code');
             });
diff --git a/tests/Auth/ElevatedSessionTest.php b/tests/Auth/ElevatedSessionTest.php
index aba4f058c63..8a5f7ee8ef2 100644
--- a/tests/Auth/ElevatedSessionTest.php
+++ b/tests/Auth/ElevatedSessionTest.php
@@ -594,7 +594,7 @@ public function frontend_middleware_denies_request_when_elevated_session_has_exp
         $this
             ->withElevatedSession(now()->subMinutes(16))
             ->get('/requires-elevated-session')
-            ->assertRedirect('/!/auth/elevated-session');
+            ->assertRedirect('/!/auth/confirm-password');
     }
 
     #[Test]
@@ -616,7 +616,7 @@ public function frontend_elevated_session_redirects_to_custom_url_when_configure
 
         $this
             ->actingAs($this->user)
-            ->get('/!/auth/elevated-session')
+            ->get('/!/auth/confirm-password')
             ->assertRedirect('/custom-elevated-session');
     }
 
@@ -627,7 +627,7 @@ public function frontend_elevated_session_shows_inertia_page_when_no_custom_url(
 
         $this
             ->actingAs($this->user)
-            ->get('/!/auth/elevated-session')
+            ->get('/!/auth/confirm-password')
             ->assertInertia(fn ($page) => $page
                 ->component('auth/ConfirmPassword')
                 ->where('outside', true)
@@ -679,7 +679,7 @@ public function frontend_verification_code_will_be_sent_for_passwordless_user_wh
 
         $this
             ->actingAs($user = tap(User::make()->email('foo@bar.com')->makeSuper())->save())
-            ->get('/!/auth/elevated-session')
+            ->get('/!/auth/confirm-password')
             ->assertSessionHas('statamic_elevated_session_verification_code', [
                 'code' => 'abc',
                 'generated_at' => now()->timestamp,

From bc4a34602d413edb8747e044aa52dac1e6e6b225 Mon Sep 17 00:00:00 2001
From: Duncan McClean <duncan@duncanmcclean.com>
Date: Thu, 2 Apr 2026 12:27:42 +0100
Subject: [PATCH 4/4] fix "resend code" button

---
 resources/js/pages/auth/ConfirmPassword.vue             | 2 +-
 src/Http/Controllers/Auth/ElevatedSessionController.php | 5 +++--
 tests/Auth/ElevatedSessionTest.php                      | 8 ++++----
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/resources/js/pages/auth/ConfirmPassword.vue b/resources/js/pages/auth/ConfirmPassword.vue
index 86d0c7b3b4c..064d1bb956f 100644
--- a/resources/js/pages/auth/ConfirmPassword.vue
+++ b/resources/js/pages/auth/ConfirmPassword.vue
@@ -54,7 +54,7 @@ async function confirmWithPasskey() {
 
                 <Button
                     v-if="isUsingVerificationCode"
-                    as="href"
+                    as="a"
                     class="flex-1"
                     :href="resendUrl"
                     :text="__('Resend code')"
diff --git a/src/Http/Controllers/Auth/ElevatedSessionController.php b/src/Http/Controllers/Auth/ElevatedSessionController.php
index f90c92a7138..42f3eead141 100644
--- a/src/Http/Controllers/Auth/ElevatedSessionController.php
+++ b/src/Http/Controllers/Auth/ElevatedSessionController.php
@@ -62,7 +62,8 @@ protected function buildConfirmResponse(Request $request, $user)
             ? __('Password confirmed')
             : __('Code verified');
 
-        $redirect = redirect()->intended(route('statamic.site'));
+        $default = $request->input('_redirect') ?? route('statamic.site');
+        $redirect = redirect()->intended($default);
 
         if ($request->wantsJson()) {
             return response()->json([
@@ -94,7 +95,7 @@ public function resendCode()
 
         session()->sendElevatedSessionVerificationCode();
 
-        return back()->with('success', __('statamic::messages.elevated_session_verification_code_sent'));
+        return back()->with('status', __('statamic::messages.elevated_session_verification_code_sent'));
     }
 
     private function validatePasswordConfirmation(Request $request, $user): void
diff --git a/tests/Auth/ElevatedSessionTest.php b/tests/Auth/ElevatedSessionTest.php
index 8a5f7ee8ef2..c1364fcf2aa 100644
--- a/tests/Auth/ElevatedSessionTest.php
+++ b/tests/Auth/ElevatedSessionTest.php
@@ -378,7 +378,7 @@ public function the_verification_code_can_be_resent()
             ->from('/original')
             ->get(cp_route('elevated-session.resend-code'))
             ->assertRedirect('/original')
-            ->assertSessionHas('success')
+            ->assertSessionHas('status')
             ->assertSessionHas('statamic_elevated_session_verification_code', [
                 'code' => 'abc',
                 'generated_at' => now()->timestamp,
@@ -402,12 +402,12 @@ public function resending_code_is_rate_limited()
                 ->get(cp_route('elevated-session.resend-code'));
         };
 
-        $request()->assertRedirect('/original')->assertSessionHas('success');
+        $request()->assertRedirect('/original')->assertSessionHas('status');
         $request()->assertRedirect('/original')->assertSessionHas('error', 'Try again in a minute.');
         $this->travel(30)->seconds();
         $request()->assertRedirect('/original')->assertSessionHas('error', 'Try again in a minute.');
         $this->travel(1)->minute();
-        $request()->assertRedirect('/original')->assertSessionHas('success');
+        $request()->assertRedirect('/original')->assertSessionHas('status');
 
         Notification::assertCount(2);
     }
@@ -701,7 +701,7 @@ public function frontend_verification_code_can_be_resent()
             ->from('/original')
             ->get('/!/auth/elevated-session/resend-code')
             ->assertRedirect('/original')
-            ->assertSessionHas('success')
+            ->assertSessionHas('status')
             ->assertSessionHas('statamic_elevated_session_verification_code', [
                 'code' => 'abc',
                 'generated_at' => now()->timestamp,