dbsc

Tech stack & purpose

Device Bound Session Credentials (DBSC) is a protocol designed to reduce account hijacking caused by cookie theft by binding authentication sessions to cryptographic keys stored on a user's device. Developed by Kristian Monsen and Arnar Birgisson at Google, DBSC introduces browser infrastructure and APIs that maintain and prove possession of device-bound private keys, allowing servers to verify that requests originate from the original device where a session was established. The protocol works by initiating a session at sign-in, which triggers key creation; the browser then ensures required cookies exist by periodically refreshing them with cryptographic proof-of-possession, without requiring changes to most existing website endpoints. Chrome's implementation backs these keys with a Trusted Platform Module (TPM) on Windows, though the specification allows other key storage technologies, and the protocol emphasizes privacy by preventing cross-site tracking and ensuring sessions are cleared with other site data.

Community & reference links

• Token Binding

Languages

Contributors

• kmonsen82 commits
• Daniel Rubery79 commits
• Sameera Gajjarapu54 commits
• thefrog-gh10 commits
• Matt MacAdam5 commits
• Kristian Monsen3 commits
• Arnar Birgisson3 commits
• Simone Onofri3 commits
• danmarg3 commits
• Shane Weeden2 commits
• Nathan Parker2 commits
• Yoav Weiss2 commits
• Apoorva Deshpande2 commits
• 
  David Frankel2 commits · 13 followers
• Halflight2 commits
• Francois Marier1 commits
• Yoshikazu Nojima1 commits
• Tyler Morgan1 commits
• Mike West1 commits
• Jan Wilken Dörrie1 commits
• Boris1 commits
• Dean Xu1 commits
• Chao Chen1 commits