WICG Device Bound Session Credentials (DBSC) Hardware PoP and Anti-Replay Guardrail

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Silent downgrade or replay vulnerability via unverified DBSC challenge responses, stale nonces, or permissive fallback to standard bearer cookies) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

WICG Device Bound Session Credentials (DBSC) Hardware PoP and Anti-Replay Guardrail

--- description: WICG Device Bound Session Credentials (DBSC) Hardware PoP and Anti-Replay Guardrail - Protects authentication sessions against infostealer malware by binding session cookies directly to TPM or Secure Enclave hardware keys via WICG Device Bound Session Credentials (DBSC). Mandates server-side validation of client challenge signatures, cryptographic nonce freshness, and strict session invalidation upon proof-of-possession mismatch to prevent downgrade and token-replay attacks. globs: src/auth/**/*.{ts,tsx,js}, src/middleware/**/*.{ts,tsx,js}, src/security/**/*.{ts,tsx,js}, src/server/**/*.{ts,tsx,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wicg-dbsc-session-attestation-guardrail" --- # WICG Device Bound Session Credentials (DBSC) Hardware PoP and Anti-Replay Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Silent downgrade or replay vulnerability via unverified DBSC challenge responses, stale nonces, or permissive fallback to standard bearer cookies ## System Constraints You are a Principal Security Architect enforcing WICG Device Bound Session Credentials (DBSC) specifications. Ensure that all session refresh mechanisms enforce hardware-backed key binding (TPM / Secure Enclave), validate single-use challenge nonces atomically, set ultra-short TTLs on session cookies, and immediately terminate sessions on proof-of-possession (PoP) verification failures without allowing silent downgrades to standard cookies. ## Strict Guidelines - Engineers MUST ALWAYS enforce short-lived session cookies (max 15 minutes) when DBSC is active, relying on client-side hardware-signed refresh cycles for continuity. - Engineers MUST ALWAYS issue single-use, cryptographically secure nonces in `Sec-Session-Challenge` headers and verify freshness against an atomic store with tight TTLs (<= 60 seconds). - Services MUST atomically consume and invalidate nonces upon first receipt to prevent challenge-response replay attacks across concurrent connections. - Services MUST reject requests and immediately revoke the parent session when `Sec-Session-Response` signature verification fails or the hardware public key does not match the enrolled device key. - Components NEVER fall back to standard cookie validation if a session has been established as hardware-bound; any failure in the DBSC proof-of-possession handshake MUST invalidate the session. - Engineers MUST validate the complete JWT payload in `Sec-Session-Response`, explicitly verifying the audience, origin, algorithm (e.g., ES256, RS256), and embedded challenge nonce. ## Bad vs Good Implementations ### DBSC Refresh Endpoint Verification and Anti-Replay Guardrail #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad example permits fallback to non-bound sessions, decodes the JWT without cryptographic verification against the enrolled TPM/Enclave public key, fails to validate nonce freshness atomically, and issues a 7-day bearer cookie that remains completely vulnerable to infostealer malware. ```typescript import { Request, Response } from 'express'; import jwt from 'jsonwebtoken'; import { db } from './database'; export async function refreshDbscSession(req: Request, res: Response) { const sessionId = req.cookies['session_id']; const sessionResponseHeader = req.headers['sec-session-response'] as string; // BAD: Falling back to normal session refresh if header is missing if (!sessionResponseHeader) { return res.json({ status: 'refreshed_without_dbsc' }); } // BAD: Decoding without verifying signature against stored hardware key const decoded = jwt.decode(sessionResponseHeader) as { nonce: string; jwk: any }; // BAD: Nonce is not checked for replay against an atomic store if (!decoded || !decoded.nonce) { return res.status(400).send('Invalid response'); } const session = await db.sessions.findById(sessionId); // BAD: Reissuing long-lived cookie defeats DBSC infostealer mitigation res.cookie('auth_token', session.token, { httpOnly: true, secure: true, maxAge: 7 * 24 * 60 * 60 * 1000 // 7 days }); return res.status(200).json({ ok: true }); } ``` #### Production Standard (Correct) > **Standard**: The good example cryptographically validates the hardware-backed ES256 key signature, verifies the audience, atomically burns the challenge nonce in Redis, terminates the session immediately upon any validation failure, and issues short-lived (15 min) __Host- cookies. ```typescript import { Request, Response } from 'express'; import { importJWK, jwtVerify } from 'jose'; import { redisClient } from './redis'; import { db } from './database'; export async function refreshDbscSession(req: Request, res: Response) { const sessionId = req.cookies['__Host-dbsc-session']; const sessionResponseHeader = req.headers['sec-session-response'] as string | undefined; if (!sessionId) { return res.status(401).json({ error: 'Missing session identifier' }); } const session = await db.sessions.findById(sessionId); if (!session || !session.isDeviceBound) { return res.status(401).json({ error: 'Invalid or non-bound session' }); } // DBSC-bound sessions MUST reject requests missing the cryptographic response if (!sessionResponseHeader) { await db.sessions.revoke(sessionId); res.clearCookie('__Host-dbsc-session', { path: '/', secure: true, httpOnly: true }); return res.status(403).json({ error: 'DBSC proof-of-possession required; session revoked' }); } try { const publicKey = await importJWK(session.enrolledPublicKeyJwk, 'ES256'); const { payload } = await jwtVerify(sessionResponseHeader, publicKey, { algorithms: ['ES256'], audience: 'https://auth.example.com/dbsc/refresh' }); const clientNonce = payload.nonce as string; if (!clientNonce) { throw new Error('Missing challenge nonce'); } // Atomically consume nonce to eliminate replay attack windows const nonceKey = `dbsc:nonce:${sessionId}:${clientNonce}`; const wasConsumed = await redisClient.del(nonceKey); if (wasConsumed !== 1) { throw new Error('Replayed or expired challenge nonce'); } // Rotate session cookies with strictly bounded short TTL (<= 15 minutes) const newCookieSecret = crypto.randomUUID(); await db.sessions.updateSecret(sessionId, newCookieSecret); res.cookie('__Host-auth-token', newCookieSecret, { httpOnly: true, secure: true, sameSite: 'strict', path: '/', maxAge: 15 * 60 * 1000 // 15 minutes short TTL }); return res.status(204).end(); } catch (error) { // Hard invalidation on signature or nonce failure - no fallback allowed await db.sessions.revoke(sessionId); res.clearCookie('__Host-dbsc-session', { path: '/', secure: true, httpOnly: true }); res.clearCookie('__Host-auth-token', { path: '/', secure: true, httpOnly: true }); return res.status(401).json({ error: 'Cryptographic attestation failed. Session terminated.' }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WICG Device Bound Session Credentials (DBSC) Hardware PoP and Anti-Replay Guardrail

WICG Device Bound Session Credentials (DBSC) Hardware PoP and Anti-Replay Guardrail defines an industrial-grade behavioral standard for security engineering. Protects authentication sessions against infostealer malware by binding session cookies directly to TPM or Secure Enclave hardware keys via WICG Device Bound Session Credentials (DBSC). Mandates server-side validation of client challenge signatures, cryptographic nonce freshness, and strict session invalidation upon proof-of-possession mismatch to prevent downgrade and token-replay attacks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Silent downgrade or replay vulnerability via unverified DBSC challenge responses, stale nonces, or permissive fallback to standard bearer cookies Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Silent downgrade or replay vulnerability via unverified DBSC challenge responses, stale nonces, or permissive fallback to standard bearer cookies	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce short-lived session cookies (max 15 minutes) when DBSC is active, relying on client-side hardware-signed refresh cycles for continuity.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.