v135 · security

Device Bound Session Credentials

To enhance user security and combat session cookie theft, Chrome is introducing [Device Bound Session Credentials (DBSC)](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials). This feature allows websites to bind a user's session to their specific device, which makes it significantly more difficult for stolen session cookies to be

concepts

  1. DBSC live handshake

    End-to-end backend flow: the server emits Secure-Session-Registration, the page signs an ES256 proof, and the backend verifies it before issuing cookies.

  2. Cookie replay attack lab

    Run the real backend refresh challenge twice: once with Alice's registered key and once with an attacker key that copied only the cookie. The attacker proof is rejected.

  3. Session handshake walkthrough

    Step through the full DBSC handshake on a ladder diagram: login, Secure-Session-Registration, WebCrypto proof, refresh challenge, and signed renewal.

  4. Token Lifecycle Tracker

    Backend-backed token lifecycle lab showing login, registration, short-lived cookie expiry, refresh challenge, signed proof, and renewed session state.

why it shipped

Reduce session theft by offering an alternative to long-lived cookie bearer tokens, that allows session authentication that is bound to the user's device. This makes the web safer for users in that it is less likely their identity is abused, since malware is forced to act locally and thus becomes easier to detect and mitigate. At the same time the goal is to disrupt the cookie theft ecosystem and force it to adapt to new protections.

references