Support Device Bound Session Credentials (DBSC)

[blowdart]

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

We have been trying to support device bound credentials for ages, but there has never been a standard that both Google and Microsoft agreed on, until now.

Describe the solution you'd like

Last month Google announced a joint standard with Microsoft that binds cookies for TPM.

This will take work. The approach uses short lived auth cookies, which require an implementation of session, and some new endpoints for cookie refresh.

It is additive, it can stop on top of the existing authentication cookie middleware, but the need for session is something we've typically avoided.

The spec is still a draft, but given the cooperation with Microsoft, Okta et al, it's going to rapidly be a defacto standard before it makes it out of RFC.

Additional context

No response

[github-actions]

Triage Summary

Area: area-security + area-auth (already labeled area-identity and area-security — DBSC sits on top of cookie authentication middleware, so area-auth may also be relevant, but the existing labels cover the core concern)
Type: feature-request — This is a request to implement a new W3C/browser standard (Device Bound Session Credentials) that doesn't currently exist in ASP.NET Core.

Potential Duplicates

• None found — searches for "Device Bound Session Credentials DBSC" and "TPM bound cookies authentication" returned no prior issues.

Notes

• The spec ((w3c.github.io/redacted) is still a draft, so implementation timing may need to track its standardization progress.
• The feature is additive on top of existing cookie authentication middleware but introduces a session requirement that the team has historically avoided.
• Given joint Microsoft/Google/Okta backing, this is likely to become a de facto standard quickly.

Generated by Issue Triage Agent for dotnet/aspnetcore for issue #66478 · ● 164.1K · ◷

[SulimanAbdulrazzaq]

Having implemented DBSC end-to-end, my impression is that the protocol mechanics aren't the difficult part. The real challenge is introducing a short-lived session-and-refresh model into authentication systems that have intentionally minimized server-side state.

For ASP.NET Core, what would be considered the "right" home for that responsibility? Cookie middleware, an authentication handler, or an entirely separate abstraction?

I think the answer to that question is more important than the DBSC endpoints themselves.