← back to v142 · device-bound-session-credentials

conformance · v142

v142 · device-bound-session-credentials — conformance probe

6 assertions drawn from the spec. Each is a single contract the spec text makes. Pass/fail reflects what this browser executed; blocked means the contract was not run because it needs user mediation, hardware, or another unavailable precondition. Open the page in Chrome stable / canary / Firefox / Safari to compare.

browser: spec: https://w3c.github.io/webappsec-dbsc/ chromestatus: #5140168270413824 generated 2026-06-01T08:13:10Z by conformance-author-v1-subagent
0
pass
0
fail
0
blocked
6
total
id contract kind verdict detail
secure-context DBSC is gated to secure contexts; the page must be HTTPS or localhost. script
fetch-exists DBSC piggybacks on fetch — Secure-Session-Registration arrives on a fetch response and the refresh request is a fetch. typeof
no-js-surface-leaked DBSC is intentionally invisible to JavaScript — there is no navigator.deviceBoundSessions object. Sites cannot enumerate or forge bindings. script
headers-can-carry-sec-session-id Headers can carry the Sec-Secure-Session-Id token; userland can observe response headers in principle though DBSC headers are filtered. script
credentials-include-still-supported fetch still accepts credentials: 'include' — DBSC binds the session but does not remove the cookie-credentialed fetch mode. script
subtlecrypto-available DBSC relies on per-device key pairs; SubtleCrypto is the user-agent surface used internally and remains exposed to userland. typeof