v145 · Security · Cookie Lifecycle
Cookie lifecycle lab
Exercise a DBSC-shaped session against the showcase backend: login response, registration proof, short-lived cookie, expired resource request, refresh challenge, signed proof, and renewed cookie.
Backend-backed. The server issues
Secure-Session-Registration and
Secure-Session-Challenge headers. The page signs dbsc+jwt proofs with
WebCrypto so the backend can verify possession of the registered key.
run a session
-Click "Login + register" to begin.idle
No backend state loaded yet.
state machine
// 1. Login: server returns Secure-Session-Registration + long-lived cookie
// 2. Browser creates a device-bound key, sends Secure-Session-Response proof
// 3. Server verifies the proof, stores the public key, returns short-lived cookie
// 4. Cookie expires; refresh endpoint returns Secure-Session-Challenge
// 5. Browser signs that challenge using the bound private key
// 6. Server verifies the signature and issues a fresh short-lived cookie