demo · v142

DBSC Walkthrough

Pick a scenario and step through what happens. Honest user, attacker on a different device, or attacker on the same device — see why a hardware-backed key on the original device kills bearer-token replay.

Pick a scenario and press Play.

Walkthrough of the DBSC handshake. Real DBSC requires server support for the refresh challenge and a TPM/secure-element on the client.

relevant API

// Server opt-in
Sec-Session-Registration: (RS256 ES256); path="/dbsc/start"; challenge="…"

// Client signs a refresh JWT with its hardware-backed key on every refresh.
// No key → no fresh session cookie → request fails.

see also