Andrew Lock • 9/15/2026

Understanding Device Bound Session Credentials (DBSC)

This article introduces Device Bound Session Credentials (DBSC), a protocol designed to prevent cookie theft and session hijacking by binding authentication cookies to a specific device. It explains how DBSC uses TPM-stored private keys to sign requests, ensuring cookies can't be used elsewhere. The post covers the problem DBSC solves, how the protocol works, and implementation guidance for servers and browsers.

0 comments

#security #authentication #Cookies