demo · v135
Session handshake walkthrough
Step through a full DBSC handshake — from Secure-Session-Registration response header to the rotating short-lived cookie — on a ladder diagram. Each step lights up as the page calls the backend and signs proofs.
WebCrypto: ?
This walkthrough calls the showcase backend. The server emits
Secure-Session-Registration and Secure-Session-Challenge; this page signs dbsc+jwt proofs with WebCrypto so the server can verify the session binding.browser
1. POST /login
3. generate P-256 key in WebCrypto
5. request refresh challenge after cookie expiry
7. call protected resource with renewed cookie
→
←
→
←
→
server
2. response:
Secure-Session-Registration: ...4. verifies registration proof + stores public key
6. verifies refresh proof + renews short cookie
8. resource returns device-bound account data