← back to v142 · device-bound-session-credentials
conformance · v142
v142 · device-bound-session-credentials — conformance probe
6 assertions drawn from the spec. Each is a single contract the spec text makes. Pass/fail reflects what this browser executed; blocked means the contract was not run because it needs user mediation, hardware, or another unavailable precondition. Open the page in Chrome stable / canary / Firefox / Safari to compare.
0
pass
0
fail
0
blocked
6
total
| id | contract | kind | verdict | detail |
|---|---|---|---|---|
secure-context |
DBSC is gated to secure contexts; the page must be HTTPS or localhost. | script | … | |
fetch-exists |
DBSC piggybacks on fetch — Secure-Session-Registration arrives on a fetch response and the refresh request is a fetch. | typeof | … | |
no-js-surface-leaked |
DBSC is intentionally invisible to JavaScript — there is no navigator.deviceBoundSessions object. Sites cannot enumerate or forge bindings. | script | … | |
headers-can-carry-sec-session-id |
Headers can carry the Sec-Secure-Session-Id token; userland can observe response headers in principle though DBSC headers are filtered. | script | … | |
credentials-include-still-supported |
fetch still accepts credentials: 'include' — DBSC binds the session but does not remove the cookie-credentialed fetch mode. | script | … | |
subtlecrypto-available |
DBSC relies on per-device key pairs; SubtleCrypto is the user-agent surface used internally and remains exposed to userland. | typeof | … |