diff --git a/castellum_core/castellum_core/castellum_auth/middlewares.py b/castellum_core/castellum_core/castellum_auth/middlewares.py
new file mode 100644
index 0000000000000000000000000000000000000000..a080b8cac9b0929237ba3e8c0722ffb23c1ce930
--- /dev/null
+++ b/castellum_core/castellum_core/castellum_auth/middlewares.py
@@ -0,0 +1,23 @@
+from django.contrib import messages
+from django.contrib.auth import logout
+from django.utils import timezone
+from django.utils.translation import ugettext_lazy as _
+
+
+class UserExpirationMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if request.user.is_authenticated and not request.user.is_superuser:
+            error = None
+            if not request.user.expiration_date:
+                error = _('Your account is not activated.')
+            elif request.user.expiration_date < timezone.now():
+                error = _('Your account is expired.')
+
+            if error is not None:
+                logout(request)
+                messages.add_message(request, messages.ERROR, error)
+
+        return self.get_response(request)
diff --git a/castellum_core/castellum_core/castellum_core/settings/default.py b/castellum_core/castellum_core/castellum_core/settings/default.py
index bfe1c0d0c7a1f6f3d6be548571c6b98e6b30abf0..38f05678ab233a0deffef14c94f5620a57c9e3c9 100644
--- a/castellum_core/castellum_core/castellum_core/settings/default.py
+++ b/castellum_core/castellum_core/castellum_core/settings/default.py
@@ -28,6 +28,8 @@ MIDDLEWARE = [
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
+
+    'castellum_auth.middlewares.UserExpirationMiddleware',
 ]
 
 ROOT_URLCONF = 'castellum_core.urls'
@@ -113,3 +115,15 @@ NPM_ROOT_PATH = os.path.dirname(BASE_DIR)
 NPM_FILE_PATTERNS = {
     'bootstrap': ['dist/css/bootstrap.min.css'],
 }
+
+# adapt message classes for bootstrap
+
+from django.contrib.messages import constants as messages
+
+MESSAGE_TAGS = {
+    messages.DEBUG: 'light',
+    messages.INFO: 'info',
+    messages.SUCCESS: 'success',
+    messages.WARNING: 'warning',
+    messages.ERROR: 'danger',
+}
diff --git a/castellum_core/castellum_core/templates/base.html b/castellum_core/castellum_core/templates/base.html
index 32d53c25910a1217a3c65153db41b5094e0462d3..8dbf12b97721cdc734877ca9d324c1b787066a67 100644
--- a/castellum_core/castellum_core/templates/base.html
+++ b/castellum_core/castellum_core/templates/base.html
@@ -31,13 +31,11 @@
         <div class="row justify-content-center">
             <div class="col-lg-8 col-md-10">
                 {% if messages %}
-                    <ul class="messages">
-                        {% for message in messages %}
-                            <li class="alert {{ message.tags }}" role="alert">
-                                {{ message }}
-                            </li>
-                        {% endfor %}
-                    </ul>
+                    {% for message in messages %}
+                        <div class="alert alert-{{ message.tags }}" role="alert">
+                            {{ message }}
+                        </div>
+                    {% endfor %}
                 {% endif %}
 
                 {% block content %}{% endblock %}
diff --git a/castellum_core/tests/castellum_auth/test_middlewares.py b/castellum_core/tests/castellum_auth/test_middlewares.py
new file mode 100644
index 0000000000000000000000000000000000000000..08cf5b68cc517c6b033524a4f44ba171c72842a7
--- /dev/null
+++ b/castellum_core/tests/castellum_auth/test_middlewares.py
@@ -0,0 +1,26 @@
+import pytest
+
+from django.utils import timezone
+
+from castellum_auth.models import User
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize('expiration_date,expected', (
+    (None, False),
+    (timezone.now() - timezone.timedelta(days=10), False),
+    (timezone.now() + timezone.timedelta(days=10), True),
+))
+def test_user_expiration_date(client, expiration_date, expected):
+    user = User.objects.create(expiration_date=expiration_date)
+    client.force_login(user)
+    response = client.get('/')
+    assert response.wsgi_request.user.is_authenticated == expected
+
+
+@pytest.mark.django_db
+def test_user_expiration_date_superuser(client):
+    user = User.objects.create(expiration_date=None, is_superuser=True)
+    client.force_login(user)
+    response = client.get('/')
+    assert response.wsgi_request.user.is_authenticated