On September 3, 2025, the Web Application Security Working Group at the World Wide Web Consortium (W3C) published the First Public Working Draft of Device Bound Session Credentials (DBSC) , marking a significant step toward enhancing web security. This innovative standard aims to address a persistent threat in web authentication: cookie theft , a common method used by attackers to hijack user sessions. By introducing a robust protocol and infrastructure, DBSC enables user agents (such as browsers) to securely assert possession of a private key, creating a stronger binding between a user’s device and their session. In this blog post, we’ll dive into the details of DBSC, its significance, how it works, and what it means for the future of web security. What Are Device Bound Session Credentials (DBSC)? Device Bound Session Credentials (DBSC) is both a Web API and a protocol designed to prevent unauthorized session hijacking by ensuring that session credentials are cryptographically ...