Introduction
Device Bound Session Credentials (DBSC) provides cryptographic protection against off-device cookie theft by binding sessions to a user's device. Currently, DBSC relies on asynchronous HTTP headers for session initialization.
This asynchronous nature creates an observability gap for websites, especially Identity Providers that require deterministic guarantees of session establishment before granting access.
The Explainer proposes a new JavaScript API that provides a synchronization mechanism for websites to wait for DBSC registrations.
Feedback
I welcome feedback in this thread, but encourage you to file bugs against the Explainer.
Introduction
Device Bound Session Credentials (DBSC) provides cryptographic protection against off-device cookie theft by binding sessions to a user's device. Currently, DBSC relies on asynchronous HTTP headers for session initialization.
This asynchronous nature creates an observability gap for websites, especially Identity Providers that require deterministic guarantees of session establishment before granting access.
The Explainer proposes a new JavaScript API that provides a synchronization mechanism for websites to wait for DBSC registrations.
Feedback
I welcome feedback in this thread, but encourage you to file bugs against the Explainer.