Device Bound Session Credentials (DBSC) for cookie authentication (prototype)

[rokonec]

Device Bound Session Credentials (DBSC) for cookie authentication (prototype)

Draft / prototype. The public API is gated behind the experimental analyzer diagnostic ASP0030. The wire protocol is a W3C Editor's Draft ("may change at any moment") and is shipping single-vendor (Chromium) behind a flag, so both the protocol and this API are expected to change. This PR is for design review, not merge.

What this adds

A new experimental authentication component, Microsoft.AspNetCore.Authentication.DeviceBoundSessions, that implements the server side of Device Bound Session Credentials. DBSC binds a browser session to a device-held private key: the short-lived session cookie is periodically refreshed only when the browser can produce a fresh signed proof-of-possession, so a stolen cookie alone is useless.

It is designed as a drop-in hardening layer over an existing cookie auth scheme: you point it at a "source" sign-in scheme and it manages the registration handshake, a path-scoped refresh cookie, and a short-lived session cookie.

Shape of the API

builder.Services.AddAuthentication()
    .AddCookie("Application", o => { /* normal sign-in cookie */ })
    .AddDeviceBoundSession("Application", o =>
    {
        o.ShortLivedCookieExpiration = TimeSpan.FromMinutes(10);
        o.ScopeSpecifications.Add(new DeviceBoundSessionScopeRule { /* ... */ });
    });

All public types carry [Experimental("ASP0030")]; consumers must explicitly opt in.

How it works

• Registration (/.well-known/dbsc/registration): validates the browser's signed proof JWT, binds it to the authenticated principal via a data-protected, time-limited challenge, then stamps a path-scoped refresh cookie (carrying the device public key + session id) and a short-lived session cookie.
• Refresh (/.well-known/dbsc/refresh): authenticates the refresh cookie, issues a Secure-Session-Challenge (403), validates the returned proof JWT signature against the bound key and the challenge binding, then re-mints the short-lived session cookie.
• Domain separation: registration and refresh challenges use distinct data-protection purposes, so a challenge from one flow can never be decrypted or confused as the other.
• Lifetime: the refresh cookie inherits the source scheme's ExpireTimeSpan/SlidingExpiration and slides exactly like the auth cookie it replaces (no session-lifetime regression when DBSC is enabled). The session cookie stays deliberately short-lived and non-sliding.
• Logging: per-reason LoggerMessage events for every validation failure (challenge undecryptable/malformed/mismatch, proof malformed/wrong-typ/unsupported-alg/bad-signature), at Debug, never logging secrets.

Components

• Handler, options, extensions, and DTOs under src/Security/Authentication/DeviceBoundSessions/src/
• Challenge protector (CBOR payloads, time-limited data protection) and JWT proof validator (ES256/RS256)
• DbscDebugServer sample with a live dashboard that decodes cookies, proofs, and challenges for inspection
• Tests for the challenge protector, JWT validator, and derived cookie protection/sliding

Testing

• src/Security/Authentication/test/DeviceBoundSessions/ — 38 tests covering challenge round-trips and domain separation, JWT proof validation, data-protection of derived cookies, and refresh-cookie sliding inheritance.
• Manually exercised end-to-end against Chromium (registration → refresh → slide) via the DbscDebugServer sample.

Open questions for review

• Protocol is an unstable Editor's Draft; we have already absorbed breaking changes (header renames, 401→403 re-challenge). Is experimental gating the right call, or should this live out-of-band until the spec stabilizes?
• Diagnostic id ASP0030 is reserved in docs/list-of-diagnostics.md; confirm allocation.
• Cookie attributes advertised in the session instruction are currently hard-coded rather than derived from the session scheme's cookie builder.
• DbscDebugServer is not sample but tool, we shall consider if we keep it, and if we add or replace it with some simple sample customers can follow
• /plans/dbsc-design.md is residual planning document which shall be removed before merge, we keeping it for now for reviewers

References

Specification

• W3C DBSC spec (Editor's Draft) — https://w3c.github.io/webappsec-dbsc/
  Status: Editor's Draft, 17 April 2026 — "may change at any moment." Lowest standardization maturity.
• Spec source repo (issues/discussion) — https://github.com/w3c/webappsec-dbsc
• Original WICG explainer — https://github.com/WICG/dbsc

Browser implementation & documentation

• Chrome developer guide — https://developer.chrome.com/docs/web-platform/device-bound-session-credentials
• Feature flag — chrome://flags/#enable-standard-device-bound-session-credentials
• Chrome Platform Status — https://chromestatus.com/feature/5145745492248576

Chromium source code

• Network stack implementation — https://source.chromium.org/chromium/chromium/src/+/main:net/device_bound_sessions/
• Code search (all DBSC references) — https://source.chromium.org/search?q=device_bound_sessions

TODO

• Decide future and clean DbscDebugServer
• Consider to create simple sample
• Delete /plans/dbsc-design.md

[rokonec]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved. The only conflict was in AspNetCore.slnx — main had added aspnetcoretools.csproj to the /src/Tools/NativeAot/ folder, which I included alongside the existing test project. Merged in aad0d70.

[Copilot]

Pull request overview

Introduces a new experimental authentication component (Microsoft.AspNetCore.Authentication.DeviceBoundSessions) that implements the server side of the W3C Device Bound Session Credentials (DBSC) draft for hardening cookie authentication via device-bound proof-of-possession refresh.

Changes:

• Adds a new Microsoft.AspNetCore.Authentication.DeviceBoundSessions package with handler/options/extensions, JWT proof validation, and challenge protection.
• Adds unit tests for challenge protection, JWT validation, and derived-cookie protection/sliding behavior.
• Adds a DbscDebugServer sample plus repo wiring (project references, solution entries, diagnostic list update).

Reviewed changes

Copilot reviewed 42 out of 42 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/Security/Authentication/test/Microsoft.AspNetCore.Authentication.Test.csproj	References the new DeviceBoundSessions project from the shared authentication test project.
src/Security/Authentication/test/DeviceBoundSessions/DeviceBoundSessionJwtValidatorTests.cs	Adds tests covering JWT proof validation behaviors and failure modes.
src/Security/Authentication/test/DeviceBoundSessions/DeviceBoundSessionCookieProtectionTests.cs	Adds tests verifying derived cookie schemes remain data-protected and inherit sliding/lifetime behavior.
src/Security/Authentication/test/DeviceBoundSessions/DeviceBoundSessionChallengeProtectorTests.cs	Adds tests for registration/refresh challenge round-trips and domain separation.
src/Security/Authentication/test/DeviceBoundSessions/DbscProofKey.cs	Test helper for minting ES256/RS256 DBSC proof JWTs.
src/Security/Authentication/DeviceBoundSessions/src/SessionScopeRule.cs	JSON DTO for session scope rules (wire format).
src/Security/Authentication/DeviceBoundSessions/src/SessionScope.cs	JSON DTO for session scope (wire format).
src/Security/Authentication/DeviceBoundSessions/src/SessionInstruction.cs	JSON DTO for the session instruction response.
src/Security/Authentication/DeviceBoundSessions/src/SessionCredential.cs	JSON DTO for credentials list entries (cookie credential).
src/Security/Authentication/DeviceBoundSessions/src/PublicAPI.Unshipped.txt	Declares new public API surface (experimental-gated).
src/Security/Authentication/DeviceBoundSessions/src/PublicAPI.Shipped.txt	Initializes shipped API file for the new project.
src/Security/Authentication/DeviceBoundSessions/src/PostConfigureDeviceBoundSessionDerivedCookieOptions.cs	Copies cookie settings from source scheme to refresh/session derived schemes.
src/Security/Authentication/DeviceBoundSessions/src/PostConfigureDeviceBoundSessionCookieOptions.cs	Hooks Secure-Session-Registration header emission into cookie sign-in.
src/Security/Authentication/DeviceBoundSessions/src/Microsoft.AspNetCore.Authentication.DeviceBoundSessions.csproj	Defines the new package project and its references/InternalsVisibleTo.
src/Security/Authentication/DeviceBoundSessions/src/LoggingExtensions.cs	Adds source-generated logging events for DBSC validation failures.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionSourceSchemes.cs	Tracks source/derived scheme mappings for post-configure logic.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionScopeRule.cs	Options model for configuring scope rules.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionRegistrationHeader.cs	Emits the Secure-Session-Registration response header.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionOptions.cs	Options for DBSC handler (paths, schemes, lifetime, scope, allowed initiators).
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionJwtValidator.cs	Validates DBSC proof JWTs (ES256/RS256) and extracts claims.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionJwtResult.cs	Result model for validated proof JWTs.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionJsonContext.cs	Source-generated JSON serialization context for DBSC DTOs.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionHttpContextExtensions.cs	Public HttpContext extension to emit registration header for already-signed-in users.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionHandler.cs	Main protocol handler for registration/refresh endpoints and cookie minting.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionExtensions.cs	AddDeviceBoundSession(...) registration wiring (policy + derived cookie schemes + handler).
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionDefaults.cs	Default scheme and endpoint paths.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionCookieEvents.cs	Events decorator for EventsType cookie scenarios to emit registration header.
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionConstants.cs	Protocol constants (headers, algorithms, advertised list).
src/Security/Authentication/DeviceBoundSessions/src/DeviceBoundSessionChallengeProtector.cs	Time-limited DP + CBOR challenge minting/validation with domain separation.
src/Security/Authentication/DeviceBoundSessions/samples/DbscDebugServer/Properties/launchSettings.json	Launch profile for the debug server sample.
src/Security/Authentication/DeviceBoundSessions/samples/DbscDebugServer/Program.cs	Debug server sample host and endpoints for manual protocol exercise.
src/Security/Authentication/DeviceBoundSessions/samples/DbscDebugServer/HarLoggingMiddleware.cs	Sample middleware to log traffic into HAR with DBSC annotations.
src/Security/Authentication/DeviceBoundSessions/samples/DbscDebugServer/DbscDebugServer.csproj	Sample project file referencing the new DBSC package and dependencies.
src/Security/Authentication/DeviceBoundSessions/samples/DbscDebugServer/DbscDebug.cs	Sample debug state, decoders, and capture middleware for the dashboard.
src/Security/Authentication/DeviceBoundSessions/samples/DbscDebugServer/Dashboard.cs	Embedded HTML/JS dashboard UI for live protocol inspection.
src/Security/Authentication/DeviceBoundSessions/plans/dbsc-design.md	Design document describing goals, scheme topology, protocol flow, and risks.
src/Security/Authentication/Cookies/src/Microsoft.AspNetCore.Authentication.Cookies.csproj	Adds InternalsVisibleTo for authentication tests.
eng/ProjectReferences.props	Registers the new project for reference resolution.
docs/list-of-diagnostics.md	Documents ASP0030 experimental diagnostic for DBSC APIs.
AspNetCore.slnx	Adds DeviceBoundSessions projects to the solution structure.

[rokonec]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

The merge conflicts have been resolved locally — the only conflict was the src/submodules/googletest submodule, resolved by accepting main's version. However, pushing the resulting merge commit is being blocked by repository branch protection rules (GH013: "Cannot update this protected ref"). The previous merge was pushed successfully, so this may be a recent rule change. Could you check the repository rules for roman/dbsc-prototype at https://github.com/dotnet/aspnetcore/rules?ref=refs%2Fheads%2Froman%2Fdbsc-prototype or push the merge manually? The local commit is a88bbe9954.

[halter73]

After this succeeds, the source cookie is gone and the live auth state is in the DBSC refresh/session cookies. Does a later SignOutAsync(Options.RegistrationSourceScheme) clear those derived cookies too? It looks like logout would only delete the already-removed source cookie.

Since app code does not need to know the derived scheme names to create these cookies, it should not need to know them to clear them.

[halter73]

We copy cookie attributes from the source scheme, but not its validation/revocation behavior. After DBSC registration, Identity's OnValidatePrincipal security-stamp check and any source SessionStore revocation are bypassed by the session/refresh cookies. Can we preserve those semantics? I think we might just have to copy over the event handlers from the source cookie options.

[halter73]

I don't think AddDeviceBoundSession should automatically set the specified sourceScheme as the DefaultSignInScheme. Nor should it set DefaultAuthenticationScheme . These are things that should be configured explicitly.

I know we have logic where if you have a single scheme, we treat that as the default, and this never will be a single scheme, but I don't think this is the solution.

We could have had our OIDC handler automatically configure itself as the default sign in scheme, but we don't, because we prefer to be explicit.

Identity does set default schemes in its extension methods, but it's the only thing to do so, and it's special since it takes more complete ownership of the user's Identity. None of our authentication handlers should change default schemes on their own.

[halter73]

AlowedRefreshInitiators never appears in the JSON as allowed_refresh_initiators, so setting the option has no effect. I assume we want to keep this setting, but we just weren't flowing it? Can we add a test for this?

[halter73]

Should this include OriginalPathBase, like AuthenticationHandler<T>.BuildRedirectUri(...) does for remote auth callback URLs? Maybe we should just use it?

I think the Secure-Session-Registration path has the same issue, otherwise an app mounted under /foo tells the browser to POST to /.well-known/dbsc/... instead of /foo/.well-known/dbsc/...

We should add some tests with a non-default path base too.