GitHub - w3c/webappsec-dbsc: Device Bound Session Credentials: A Protocol for Protecting From Cookie Theft

Device Bound Session Credentials (DBSC) aims to reduce account hijacking caused by cookie theft. It does so by introducing a protocol and browser infrastructure to maintain and prove possession of a cryptographic key. The main challenge with cookies as an authentication mechanism is that they only lend themselves to bearer-token schemes. On desktop operating systems, application isolation is lacki

[efcl]

Cookieのセッションが漏れるとセッションハイジャックできてしまうので、デバイスにセッションを紐づけるdevice bindingのProposal。 キーはTPMに保存する