v135 · Security · DBSC
DBSC live handshake workbench
Run a same-origin DBSC-shaped login, registration, expiry, and refresh flow. The backend emits the real Secure-Session-* headers, the page signs JWT-style proofs with WebCrypto, and the server verifies the signatures before issuing cookies.
Chrome's browser-managed DBSC flow requires supported Chrome, a secure context, and the DBSC flag or rollout. This workbench still exercises the actual server contract: response headers, session configuration JSON, ECDSA proof verification, short-lived cookies, refresh challenges, and failed-resource behavior.
run the flow
secure contextchecking
WebCryptochecking
sessionnone
registered keyno
short cookienone
pending challengenone
latest response
Click "Login and read header" to start.server events
idle
No backend calls have run yet.
what to inspect
HTTP/1.1 200 OK
Secure-Session-Registration: (ES256);path="/v135/device-bound-session-credentials/register";challenge="...";authorization="..."
POST /v135/device-bound-session-credentials/register
Secure-Session-Response: <ES256 dbsc+jwt proof with public JWK>
HTTP/1.1 403 Forbidden
Secure-Session-Challenge: "challenge_value";id="session_id"
POST /v135/device-bound-session-credentials/refresh
Secure-Session-Response: <ES256 dbsc+jwt proof over the challenge>