Support Device Bound Session Credentials (DBSC) #66478

Activity

1. blowdart

   added the

   Feature

   issue type on Apr 26, 2026
2. blowdart

   added

   area-identityIncludes: Identity and providersIncludes: Identity and providers

   area-securityIncludes: antiforgery, CSP, and security features other than authentication and authorizationIncludes: antiforgery, CSP, and security features other than authentication and authorization

   on Apr 26, 2026
3. github-actions commented on Apr 26, 2026

   

   github-actionsBot

   on Apr 26, 2026 – with GitHub Actions

   Contributor

   More actions

   Triage Summary

   Area: area-security + area-auth (already labeled area-identity and area-security — DBSC sits on top of cookie authentication middleware, so area-auth may also be relevant, but the existing labels cover the core concern)
   Type: feature-request — This is a request to implement a new W3C/browser standard (Device Bound Session Credentials) that doesn't currently exist in ASP.NET Core.

   Potential Duplicates

   • None found — searches for "Device Bound Session Credentials DBSC" and "TPM bound cookies authentication" returned no prior issues.

   Notes

   • The spec ((w3c.github.io/redacted) is still a draft, so implementation timing may need to track its standardization progress.
   • The feature is additive on top of existing cookie authentication middleware but introduces a session requirement that the team has historically avoided.
   • Given joint Microsoft/Google/Okta backing, this is likely to become a de facto standard quickly.

   Generated by Issue Triage Agent for dotnet/aspnetcore for issue #66478 · ● 164.1K · ◷
4. github-actions

   added

   feature-request

   on Apr 26, 2026
5. mikekistler

   added this to the .NET 11 Planning milestone on May 19, 2026
6. rokonec

   self-assigned this

   on May 28, 2026
7. SulimanAbdulrazzaq commented on Jun 10, 2026

   

   SulimanAbdulrazzaq

   on Jun 10, 2026

   More actions

   Having implemented DBSC end-to-end, my impression is that the protocol mechanics aren't the difficult part. The real challenge is introducing a short-lived session-and-refresh model into authentication systems that have intentionally minimized server-side state.

   For ASP.NET Core, what would be considered the "right" home for that responsibility? Cookie middleware, an authentication handler, or an entirely separate abstraction?

   I think the answer to that question is more important than the DBSC endpoints themselves.
8. javiercn

   added

   area-authIncludes: authentication, authorization, OAuth, OIDC, and access token validationIncludes: authentication, authorization, OAuth, OIDC, and access token validation

   and removed

   area-securityIncludes: antiforgery, CSP, and security features other than authentication and authorizationIncludes: antiforgery, CSP, and security features other than authentication and authorization

   on Jul 3, 2026
9. danroth27

   modified the milestones: .NET 11 Planning, .NET 12 Planning on Aug 5, 2026
10. rokonec commented on Sep 30, 2026

    

    rokonec

    on Sep 30, 2026

    Member

    More actions

    Tracking the derived session-cookie path inheritance requirement in #69618. This applies before any future DBSC reintroduction; no .NET 11 servicing change is proposed because the experimental implementation was removed by #69462/#69479.
11. rokonec commented on Sep 30, 2026

    

    rokonec

    on Sep 30, 2026

    Member

    More actions

    Tracking generated refresh/session scheme inheritance of the source scheme's DataProtectionProvider in #69619. Like #69618, this applies before any future DBSC reintroduction; the experimental implementation was removed from .NET 11 by #69462/#69479.
12. rokonec commented on Sep 30, 2026

    

    rokonec

    on Sep 30, 2026

    Member

    More actions

    Tracking DBSC composition with source schemes whose authenticate target varies per request (for example ForwardDefaultSelector) in #69620. Like #69618 and #69619, this applies before any future DBSC reintroduction.