Device Bound Session Credentials (DBSC) for cookie authentication (prototype)#67388

Open

rokonec wants to merge 34 commits into

mainfrom

roman/dbsc-prototype

Commits on Jun 3, 2026

WIP: Device Bound Session Credentials (DBSC) for cookie auth

javiercn
and
Copilot
committed

Commits on Jun 4, 2026

WIP: Add DeviceBoundSessions handler project (v2 architecture)

javiercn
and
Copilot
committed
WIP: Add v2 sample app and register project reference

javiercn
and
Copilot
committed
Add HAR logging middleware to v1 sample (debug tool)

javiercn
and
Copilot
committed
Pseudo working
javiercn
committed
Remove v1 DBSC implementation from Cookies project

javiercn
and
Copilot
committed
Improve DBSC handler: time-limited challenges, IPostConfigure, IdentityModel JWT

javiercn
and
Copilot
committed
Fix DBSC project to ship as NuGet package, not shared framework

javiercn
and
Copilot
committed
Use antiforgery-style claim UID for challenge binding

javiercn
and
Copilot
committed
Split challenge into registration/refresh, use non-allocating APIs

javiercn
and
Copilot
committed
Use CBOR for challenge payloads, remove nonce

javiercn
and
Copilot
committed
Simplify challenge: CBOR array, no nonce, WebEncoders for base64url

javiercn
and
Copilot
committed
Use bare CBOR sequence, default 10min session cookie expiry

javiercn
and
Copilot
committed
Use existing IdentityModel package, CBOR-encode claim UIDs

javiercn
and
Copilot
committed
One class per file, remove unused defaults

javiercn
and
Copilot
committed
Copy source cookie settings to derived schemes, singleton challenge protector

javiercn
and
Copilot
committed

Commits on Jun 5, 2026

Update design document with all refinements

javiercn
and
Copilot
committed

Commits on Jun 11, 2026

feat: refine DBSC challenge flow, rename session instruction DTOs, expand debug sample
rokonec
committed

Commits on Jun 23, 2026

Commits on Jun 30, 2026

Commits on Jul 13, 2026

Delete dbsc-design.md
rokonec
authored