v145 · Web APIs · Security

Device Bound Session Credentials

Chrome 145 ships Device Bound Session Credentials (DBSC) — a protocol that cryptographically binds HTTP session cookies to the device, making stolen session cookies unusable on other machines.

background

Session cookie theft (via malware, XSS, or network interception) allows attackers to hijack authenticated sessions on any device. DBSC counters this by generating a device-local key pair at session start. The server periodically issues short-lived session tokens that only Chrome can refresh — because only Chrome on the original device holds the private key.

If a session cookie is stolen and used elsewhere, the periodic refresh challenge fails (wrong device, wrong key), and the server invalidates the session. Cookie theft becomes useless for persistent access.

concepts

  1. DBSC Demo

    Runs the backend-backed registration handshake: Secure-Session-Registration, WebCrypto ES256 dbsc+jwt proof, server verification, short-lived cookie, and refresh challenge.

  2. Session Binding

    How DBSC binds sessions to devices, the periodic refresh challenge flow, what happens when a device is replaced, and server-side implementation requirements.

  3. Cookie Lifecycle

    Step-by-step lifecycle using the live DBSC backend — login, registration proof, short cookie, expiry, refresh challenge, signed proof, and fresh cookie.

  4. Threat Model

    Four attack scenarios — cookie theft, network interception, server breach, physical device access — compared side by side to show exactly what DBSC blocks, what it partially mitigates, and where it provides no protection.

the change

// DBSC is server-driven — no JavaScript API required for basic use.
// Server opts in via Secure-Session-Registration response header:

// Registration response (from server):
HTTP/1.1 200 OK
Secure-Session-Registration: (ES256);path="/StartSession";challenge="base64challenge"

// Chrome generates a device-local key pair and sends a signed response:
POST /StartSession HTTP/1.1
Secure-Session-Response: eyJ... (signed dbsc+jwt with device public key)

// Server stores device public key, issues short-lived session.
// On session expiry, server challenges browser to prove device identity.
// If challenge fails (wrong device), session is invalidated — cookie theft foiled.

references