W3C Device Bound Session Credentials (DBSC) Hardware-Enforced Cryptographic Rotation Invariant

--- description: W3C Device Bound Session Credentials (DBSC) Hardware-Enforced Cryptographic Rotation Invariant - Enforces strict server-side validation and lifecycle management of W3C Device Bound Session Credentials (DBSC) to neutralize infostealer-driven cookie hijacking. Binds short-lived session cookies to hardware-backed TPM or Secure Enclave asymmetric keypairs per origin via cryptographic challenge-response rotations. Mandates verification of single-use challenge nonces and proof-of-possession signatures before refreshing or honoring session states. globs: src/auth/**/*.{ts,js}, src/middleware/**/*.{ts,js}, src/controllers/**/*.{ts,js}, src/api/**/*.{ts,js}, src/security/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/w3c-dbsc-session-binding-guardrail" --- # W3C Device Bound Session Credentials (DBSC) Hardware-Enforced Cryptographic Rotation Invariant > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Trusting Ambient Bearer Cookies Without Cryptographic Proof-of-Possession and Hardware Key Binding ## System Constraints You are a Principal Security Architect enforcing the W3C Device Bound Session Credentials (DBSC) standard. Your mission is to ensure that all web sessions are bounded directly to client hardware TPM/Secure Enclave keys. Reject any pattern treating authentication cookies as long-lived bearer tokens susceptible to memory-scraping and infostealer exfiltration. Enforce single-use challenge verification, asymmetric signature validation (ES256/RS256), and atomic session rotation on refresh endpoints. ## Strict Guidelines - Engineers MUST ALWAYS enforce the DBSC registration flow via the 'Sec-Session-Registration' header for supported user agents, storing the client public key securely against the session ID. - Services MUST verify the 'Sec-Session-Response' header containing a signed JWT (Proof-of-Possession) against the registered client-bound public key and active challenge nonce. - Engineers MUST NOT rely on static, long-lived bearer cookies; session cookies MUST be short-lived (e.g., 5-15 minutes) and rotated exclusively via DBSC refresh challenge-response cycles. - Services MUST cryptographically invalidate challenge nonces immediately upon first presentation (preventing replay attacks) using atomic cache or distributed store transactions. - Components NEVER issue renewed session cookies if the DBSC signature verification fails or if the public key thumbprint diverges from the session's enrolled hardware key. ## Bad vs Good Implementations ### DBSC Refresh Endpoint Verification vs. Naked Cookie Refresh #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler blindly refreshes the session based purely on possession of an ambient cookie. If malware extracts this cookie via memory dumping or file scraping, it can impersonate the victim indefinitely from an arbitrary machine without triggering any security challenges. ```typescript import { Request, Response, NextFunction } from 'express'; // ANTI-PATTERN: Refreshing session cookies without DBSC proof-of-possession. // If an infostealer scrapes 'refresh_token' or 'session_id', attackers gain persistent access. export async function refreshSessionHandler(req: Request, res: Response) { const sessionId = req.cookies['session_id']; if (!sessionId) { return res.status(401).json({ error: 'Missing session cookie' }); } const session = await findSessionInDb(sessionId); if (!session || session.expiresAt < new Date()) { return res.status(401).json({ error: 'Invalid or expired session' }); } // Insecure: Re-issuing session cookies based entirely on bearer cookie possession const newSessionId = crypto.randomUUID(); await updateSessionInDb(session.id, newSessionId); res.cookie('session_id', newSessionId, { httpOnly: true, secure: true, sameSite: 'strict' }); return res.status(200).json({ status: 'refreshed' }); } ``` #### Production Standard (Correct) > **Standard**: Validates the DBSC proof-of-possession response against the hardware-bound public key stored during registration. The server atomically invalidates the single-use challenge, verifies the TPM signature via ES256, binds the session to the local hardware authenticator, and issues a fresh challenge with short-lived session credentials. ```typescript import { Request, Response } from 'express'; import * as jose from 'jose'; interface DbscSessionRecord { sessionId: string; userId: string; publicKeyJwk: jose.JWK; activeChallengeNonce: string; challengeExpiresAt: number; } // PRODUCTION INVARIANT: DBSC cryptographic challenge-response validation export async function refreshDbscSessionHandler(req: Request, res: Response) { const sessionId = req.cookies['__Host-dbsc-session']; const sessionResponseJwt = req.header('Sec-Session-Response'); if (!sessionId || !sessionResponseJwt) { return res.status(401).json({ error: 'Missing session token or Sec-Session-Response' }); } const session: DbscSessionRecord | null = await getDbscSession(sessionId); if (!session) { return res.status(401).json({ error: 'DBSC session not found' }); } // Atomically claim and invalidate the challenge nonce to prevent replay attacks const claimed = await consumeChallengeNonce(session.sessionId, session.activeChallengeNonce); if (!claimed || Date.now() > session.challengeExpiresAt) { return res.status(403).json({ error: 'Invalid or expired challenge nonce' }); } try { // Import the TPM / Secure Enclave public key bound at session registration const publicKey = await jose.importJWK(session.publicKeyJwk, 'ES256'); // Verify Proof-of-Possession signed by client's hardware platform authenticator const { payload } = await jose.jwtVerify(sessionResponseJwt, publicKey, { algorithms: ['ES256'], requiredClaims: ['nonce', 'sub', 'iat'] }); if (payload.nonce !== session.activeChallengeNonce || payload.sub !== session.sessionId) { return res.status(403).json({ error: 'Challenge nonce or subject mismatch' }); } // Issue new single-use challenge for subsequent rotation const nextChallenge = crypto.randomUUID(); await setNextChallenge(session.sessionId, nextChallenge, Date.now() + 300_000); // Rotate short-lived session cookie (valid only for 10 minutes) const newCookieSecret = crypto.randomUUID(); await updateSessionSecret(session.sessionId, newCookieSecret); res.setHeader('Sec-Session-Challenge', `"${nextChallenge}"; id="${session.sessionId}"`); res.cookie('__Host-dbsc-session', newCookieSecret, { httpOnly: true, secure: true, sameSite: 'strict', path: '/', maxAge: 10 * 60 * 1000 }); return res.status(200).json({ status: 'session_rotated_and_hardware_bound' }); } catch (err) { // Invalidate session on hardware signature verification failure await terminateSession(session.sessionId); return res.status(403).json({ error: 'Hardware proof-of-possession verification failed' }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: W3C Device Bound Session Credentials (DBSC) Hardware-Enforced Cryptographic Rotation Invariant

W3C Device Bound Session Credentials (DBSC) Hardware-Enforced Cryptographic Rotation Invariant defines an industrial-grade behavioral standard for security engineering. Enforces strict server-side validation and lifecycle management of W3C Device Bound Session Credentials (DBSC) to neutralize infostealer-driven cookie hijacking. Binds short-lived session cookies to hardware-backed TPM or Secure Enclave asymmetric keypairs per origin via cryptographic challenge-response rotations. Mandates verification of single-use challenge nonces and proof-of-possession signatures before refreshing or honoring session states. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Trusting Ambient Bearer Cookies Without Cryptographic Proof-of-Possession and Hardware Key Binding Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Trusting Ambient Bearer Cookies Without Cryptographic Proof-of-Possession and Hardware Key Binding	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce the DBSC registration flow via the 'Sec-Session-Registration' header for supported user agents, storing the client public key securely against the session ID.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.