v142 · security

Device Bound Session Credentials

To enhance user security and combat session cookie theft, Chrome is introducing [Device Bound Session Credentials (DBSC)](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials). This feature allows websites to bind a user's session to their specific device, which makes it significantly more difficult for stolen session cookies to be

concepts

  1. DBSC Walkthrough

    Pick a scenario — honest user, remote replay, or local replay — and step through the DBSC handshake to see why a hardware-backed key kills stolen-cookie attacks.

  2. Protocol Handshake

    Step through the actual HTTP / JWS exchange from the IETF draft: Sec-Session-Registration header, TPM keypair, signed JWT registration, refresh loop. The protocol view the spec text describes, made concrete.

  3. Refresh Loop Simulator

    Dial cookie lifetime, refresh percentage, and a failure mode (TPM unplugged, network drop, server revoke, cookie exfil). Watch the short-lived cookie tick down, refresh, and lapse — including the attacker-replay scenario where the cookie alone can't keep the session alive.

  4. Key Attestation Trust

    DBSC strength depends on where the key actually lives. Compare software-only fallback, TEE (Android, ChromeOS), TPM 2.0, and Secure Enclave / Strongbox — across four attack classes. Pick a tier, see scores update, and read which concrete attacks each one defeats.

  5. Software Key Fallback

    DBSC degrades gracefully when there's no hardware TPM — the session still works but loses the device-binding guarantee. Toggle between Hardware TPM and Software fallback, then step through four attack scenarios (honest user, remote replay, local replay, root malware) to see exactly which threats each key type blocks or reduces.

  6. Key Store Migration

    When a user gets a new device, DBSC re-binds the session to the new keystore. Pick old and new key tiers (software → TPM 1.2 → TPM 2.0 → Secure Enclave), step through the cross-tier registration handshake, and see how upgrading or downgrading key tier changes the session's threat model.

why it shipped

Reduce session theft by offering an alternative to long-lived cookie bearer tokens, that allows session authentication that is bound to the user's device. This makes the web safer for users in that it is less likely their identity is abused, since malware is forced to act locally and thus becomes easier to detect and mitigate. At the same time the goal is to disrupt the cookie theft ecosystem and force it to adapt to new protections.

references