Device-bound session credentials

Device-bound session credentials is a protocol to request proof of possession of a private key. Regularly confirming key possession can help protect against cookie theft.

Baseline Status: This feature is currently Limited and is missing in at least one major browser engine.

Desktop Browser Engine Support

Google Chrome

—

Unsupported

Mozilla Firefox

—

Unsupported

Apple Safari

—

Unsupported

Microsoft Edge

—

Unsupported

Mobile Browser Engine Support

Chrome Android

—

Firefox Android

—

Safari iOS

—

Specifications and References

Specification ↗ Feature XML ↗

MDN Browser Compat Data Keys:

http.headers.Sec-Secure-Session-Id ↗ http.headers.Secure-Session-Challenge ↗ http.headers.Secure-Session-Registration ↗ http.headers.Secure-Session-Response ↗ http.headers.Secure-Session-Skipped ↗