demo · v147

Protocol Walkthrough

Step through the three phases of DBSC. Click Play to highlight each phase in turn.

phase 1

device key registration

HTTP/1.1 401 Unauthorized
Sec-Session-Registration: (challenge=abc123 algs=ES256)

# Browser:
# 1. Generates a fresh hardware-backed keypair
# 2. POSTs the public key + a signed challenge

POST /sessions/register HTTP/1.1
Sec-Session-Response: jwt(eyJhbGciOiJFUzI1NiI…)

phase 2

short-lived bound cookie

HTTP/1.1 200 OK
Sec-Session-Id: a8c4f1
Set-Cookie: auth=sess_…; Max-Age=600; SameSite=Lax; Secure; HttpOnly

phase 3

proof-of-possession on refresh

POST /sessions/refresh HTTP/1.1
Cookie: auth=sess_…
Sec-Session-Response: jwt(signed-with-device-private-key)

# Server verifies the JWT against the registered public key.
# If signature checks out, hands back a fresh short-lived cookie.

see also

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗