w3c/webappsec-dbsc

View on GitHub

Device Bound Session Credentials: A Protocol for Protecting From Cookie Theft

Stars: 495
Forks: 49
Open beginner issues: 0
Indexed issues: 29
Avg merge: 1d 30m
Merged PRs (30d): 2

Dominant language: Bikeshed
License: No license data
Last GitHub push: Sep 8, 2026
Latest indexed: Sep 20, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

29 open issues indexed

Implementation report: dbsc-server (TypeScript server library for Node, Bun, Deno) Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

w3c/webappsec-dbsc#267 · Opened Sep 4, 2026
DBSC registration latency Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-dbsc#265 · Opened Aug 25, 2026
Ignore DBSC headers on connections with active TLS certificate errors Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

w3c/webappsec-dbsc#264 · Opened Jul 24, 2026
Support for Linux with KDE Wallet (KWallet) Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

w3c/webappsec-dbsc#261 · Opened Jun 22, 2026
Implementation Report: dbsc-toolkit (Node.js implementation of DBSC) Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/webappsec-dbsc#260 · 1 reaction · Opened May 24, 2026
What should happen to RPs DBSC sessions when the SP session is terminated? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#259 · 1 comment · Opened May 5, 2026
a session on the RP with the same key Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

w3c/webappsec-dbsc#258 · 4 comments · Opened May 4, 2026
Estimated Rollout for Android and iOS Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

w3c/webappsec-dbsc#256 · 4 comments · Opened May 1, 2026
Prevent risk of deadlock during session refresh Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-dbsc#255 · 1 reaction · Opened Apr 15, 2026
Federated sessions (§ 3.3) orthogonal to your stated goals? Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

w3c/webappsec-dbsc#254 · 1 comment · Opened Apr 14, 2026
Chrome DBSC: Session marked as session_ended despite valid challenge response Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#243 · 35 comments · Opened Feb 5, 2026
Alternative short-lived refresh design Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#238 · 3 comments · Opened Nov 21, 2025
Partitioned cookie support Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-dbsc#234 · Opened Nov 13, 2025
Max-Age cookie attribute in JSON session credentials resulting in registration failure Open

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

w3c/webappsec-dbsc#230 · 3 comments · Opened Oct 30, 2025
Changing which cookies are bound can be complex Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#227 · Opened Oct 1, 2025
Strategy for rejecting any non compliant DBSC user agent on the server side Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#223 · 1 comment · Opened Sep 18, 2025
Evaluate new possible credential types Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#211 · Opened Aug 15, 2025
Make challenge lifetime browser-enforced Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

w3c/webappsec-dbsc#210 · 1 comment · Opened Aug 15, 2025
JS bindings for usage of session keys Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#177 · Opened May 12, 2025
JS bindings for session registration Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#176 · Opened May 12, 2025
Consider Renaming "Device Bound Session Credentials" for Clarity Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

w3c/webappsec-dbsc#152 · 1 comment · 3 reactions · Opened Apr 24, 2025
Synchronous operation and capability discovery Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#117 · 4 comments · 2 reactions · Opened Mar 17, 2025
HTTP Message Signatures Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#112 · 7 comments · 3 reactions · Opened Mar 5, 2025
Need for attestation? Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/webappsec-dbsc#34 · 5 comments · Opened Apr 7, 2024
timed refresh mechanism Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#33 · 1 comment · Opened Apr 6, 2024
alignment with OAuth 2 flows for 1P authorization servers Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#31 · 3 comments · Opened Apr 6, 2024
Question RE: Tracking and Identity Providers Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

w3c/webappsec-dbsc#24 · 1 comment · 1 reaction · Opened Apr 4, 2024
Require request signing for proof-of-possession Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#23 · 18 comments · 4 reactions · Opened Apr 4, 2024
The scheme is a little bit redundant for a redirect-based auth Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

w3c/webappsec-dbsc#12 · 13 comments · Opened Jan 4, 2024

w3c/webappsec-dbsc

Get new issues in your inbox