|
1 | 1 | <!doctype html><html lang="en">
|
2 | 2 | <head>
|
3 | 3 | <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
|
4 |
| - <title>Device Bound Session Credentials</title> |
5 | 4 | <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
|
6 |
| - <link href="https://www.w3.org/StyleSheets/TR/2021/cg-draft" rel="stylesheet"> |
7 |
| - <meta content="Bikeshed version 97a1608be, updated Mon Feb 3 16:09:34 2025 -0800" name="generator"> |
| 5 | + <title>Device Bound Session Credentials</title> |
| 6 | + <meta content="ED" name="w3c-status"> |
| 7 | + <link href="https://www.w3.org/StyleSheets/TR/2021/W3C-ED" rel="stylesheet"> |
| 8 | + <meta content="Bikeshed version f5998b114, updated Tue Feb 18 08:22:15 2025 -0800" name="generator"> |
8 | 9 | <link href="https://w3c.github.io/webappsec-dbsc/" rel="canonical">
|
9 |
| - <meta content="855f4f997b34f9911e0c06eca8c354e82ac83156" name="revision"> |
| 10 | + <meta content="f6fe455398b50a2fdd6eb70382be30e9c65311d4" name="revision"> |
10 | 11 | <meta content="dark light" name="color-scheme">
|
11 | 12 | <link href="https://www.w3.org/StyleSheets/TR/2021/dark.css" media="(prefers-color-scheme: dark)" rel="stylesheet" type="text/css">
|
12 | 13 | <style>/* Boilerplate: style-autolinks */
|
|
732 | 733 | <div class="head">
|
733 | 734 | <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
|
734 | 735 | <h1 class="p-name no-ref" id="title">Device Bound Session Credentials</h1>
|
735 |
| - <p id="w3c-state"><a href="https://www.w3.org/standards/types/#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2025-02-10">10 February 2025</time></p> |
736 |
| - <div data-fill-with="spec-metadata"> |
737 |
| - <dl> |
738 |
| - <dt>This version: |
739 |
| - <dd><a class="u-url" href="https://w3c.github.io/webappsec-dbsc/">https://w3c.github.io/webappsec-dbsc/</a> |
740 |
| - <dt>Issue Tracking: |
741 |
| - <dd><a href="https://github.com/WICG/dbsc/issues/">GitHub</a> |
742 |
| - <dt class="editor">Editors: |
743 |
| - <dd class=" editor p-author h-card vcard" data-editor-id=" 76841" ><a class=" p-name fn u-email email" href=" mailto:[email protected]" >Kristian Monsen </a> ( <span class=" p-org org" >Google </span>) |
744 |
| - <dd class=" editor p-author h-card vcard" ><a class=" p-name fn u-email email" href=" mailto:[email protected]" >Daniel Rubery </a> ( <span class=" p-org org" >Google </span>) |
745 |
| - </dl> |
746 |
| - </div> |
| 736 | + <p id="w3c-state"><a href="https://www.w3.org/standards/types/#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2025-02-18">18 February 2025</time></p> |
| 737 | + <details open> |
| 738 | + <summary>More details about this document</summary> |
| 739 | + <div data-fill-with="spec-metadata"> |
| 740 | + <dl> |
| 741 | + <dt>This version: |
| 742 | + <dd><a class="u-url" href="https://w3c.github.io/webappsec-dbsc/">https://w3c.github.io/webappsec-dbsc/</a> |
| 743 | + <dt>Issue Tracking: |
| 744 | + <dd><a href="https://github.com/w3c/webappsec-dbsc/issues/">GitHub</a> |
| 745 | + <dt class="editor">Editors: |
| 746 | + <dd class=" editor p-author h-card vcard" data-editor-id=" 76841" ><a class=" p-name fn u-email email" href=" mailto:[email protected]" >Kristian Monsen </a> ( <span class=" p-org org" >Google </span>) |
| 747 | + <dd class=" editor p-author h-card vcard" ><a class=" p-name fn u-email email" href=" mailto:[email protected]" >Daniel Rubery </a> ( <span class=" p-org org" >Google </span>) |
| 748 | + </dl> |
| 749 | + </div> |
| 750 | + </details> |
747 | 751 | <div data-fill-with="warning"></div>
|
748 |
| - <p class="copyright" data-fill-with="copyright"><a href="https://www.w3.org/policies/#copyright">Copyright</a> © 2025 the Contributors to the Device Bound Session Credentials Specification, published by the <a href="https://www.w3.org/community/wicg/">Web Platform Incubator Community Group</a> under the <a href="https://www.w3.org/community/about/agreements/cla/">W3C Community Contributor License Agreement (CLA)</a>. |
749 |
| -A human-readable <a href="http://www.w3.org/community/about/agreements/cla-deed/">summary</a> is available. </p> |
| 752 | + <p class="copyright" data-fill-with="copyright"><a href="https://www.w3.org/policies/#copyright">Copyright</a> © 2025 <a href="https://www.w3.org/">World Wide Web Consortium</a>. <abbr title="World Wide Web Consortium">W3C</abbr><sup>®</sup> <a href="https://www.w3.org/policies/#Legal_Disclaimer">liability</a>, <a href="https://www.w3.org/policies/#W3C_Trademarks">trademark</a> and <a href="https://www.w3.org/copyright/software-license/" rel="license" title="W3C Software and Document License">permissive document license</a> rules apply. </p> |
750 | 753 | <hr title="Separator for header">
|
751 | 754 | </div>
|
752 | 755 | <div class="p-summary" data-fill-with="abstract">
|
753 | 756 | <h2 class="no-num no-toc no-ref heading settled" id="abstract"><span class="content">Abstract</span></h2>
|
754 | 757 | <p>The Device Bound Sessions Credentials (DBSC) aims to prevent hijacking via cookie theft by building a protocol and infrastructure that allows a user agent to assert possession of a securely-stored private key. DBSC is a Web API and a protocol between user agents and servers to achieve this binding.</p>
|
755 | 758 | </div>
|
756 |
| - <div data-fill-with="at-risk"></div> |
757 |
| - <h2 class="no-num no-toc no-ref heading settled" id="status"><span class="content">Status of this document</span></h2> |
| 759 | + <h2 class="no-num no-toc no-ref heading settled" id="sotd"><span class="content">Status of this document</span></h2> |
758 | 760 | <div data-fill-with="status">
|
759 |
| - <p> This specification was published by the <a href="https://www.w3.org/community/wicg/">Web Platform Incubator Community Group</a>. |
760 |
| - It is not a W3C Standard nor is it on the W3C Standards Track. |
761 |
| - |
762 |
| - Please note that under the <a href="https://www.w3.org/community/about/agreements/cla/">W3C Community Contributor License Agreement (CLA)</a> there is a limited opt-out and other conditions apply. |
763 |
| - |
764 |
| - Learn more about <a href="http://www.w3.org/community/">W3C Community and Business Groups</a>. </p> |
| 761 | + <p> This is a public copy of the editors’ draft. |
| 762 | + It is provided for discussion only and may change at any moment. |
| 763 | + Its publication here does not imply endorsement of its contents by W3C. |
| 764 | + Don’t cite this document other than as work in progress. </p> |
| 765 | + <p> <strong>Changes to this document may be tracked at <a href="https://github.com/w3c/webappsec">https://github.com/w3c/webappsec</a>.</strong> </p> |
| 766 | + <p> The ( <a href=" https://lists.w3.org/Archives/Public/public-webappsec/" >archived </a>) public mailing list <a href=" mailto:[email protected]?Subject=%5Bdbsc%5D%20PUT%20SUBJECT%20HERE" >[email protected]</a> (see <a href=" https://www.w3.org/Mail/Request" >instructions </a>) |
| 767 | + is preferred for discussion of this specification. |
| 768 | + When sending e-mail, |
| 769 | + please put the text “dbsc” in the subject, |
| 770 | + preferably like this: |
| 771 | + “[dbsc] <em>…summary of comment…</em>” </p> |
| 772 | + <p> This document was produced by the <a href="https://www.w3.org/groups/wg/webappsec">Web Application Security Working Group</a>. </p> |
| 773 | + <p> This document was produced by a group operating under |
| 774 | + the <a href="https://www.w3.org/policies/patent-policy/">W3C Patent Policy</a>. |
| 775 | + W3C maintains a <a href="https://www.w3.org/groups/wg/webappsec/ipr" rel="disclosure">public list of any patent disclosures</a> made in connection with the deliverables of the group; |
| 776 | + that page also includes instructions for disclosing a patent. |
| 777 | + An individual who has actual knowledge of a patent which the individual believes contains <a href="https://www.w3.org/policies/patent-policy/#def-essential">Essential Claim(s)</a> must disclose the information in accordance with <a href="https://www.w3.org/policies/patent-policy/#sec-Disclosure">section 6 of the W3C Patent Policy</a>. </p> |
| 778 | + <p> This document is governed by the <a href="https://www.w3.org/policies/process/20231103/" id="w3c_process_revision">03 November 2023 W3C Process Document</a>. </p> |
765 | 779 | <p></p>
|
766 | 780 | </div>
|
767 | 781 | <div data-fill-with="at-risk"></div>
|
@@ -850,6 +864,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
|
850 | 864 | <a href="#w3c-conformance"><span class="secno"></span> <span class="content">Conformance</span></a>
|
851 | 865 | <ol class="toc">
|
852 | 866 | <li><a href="#w3c-conventions"><span class="secno"></span> <span class="content">Document conventions</span></a>
|
| 867 | + <li><a href="#w3c-conformant-algorithms"><span class="secno"></span> <span class="content">Conformant Algorithms</span></a> |
853 | 868 | </ol>
|
854 | 869 | <li>
|
855 | 870 | <a href="#index"><span class="secno"></span> <span class="content">Index</span></a>
|
@@ -1490,6 +1505,22 @@ <h3 class="no-ref no-num heading settled" id="w3c-conventions"><span class="cont
|
1490 | 1505 | with <code>class="note"</code>,
|
1491 | 1506 | like this: </p>
|
1492 | 1507 | <p class="note" role="note">Note, this is an informative note.</p>
|
| 1508 | + <section> |
| 1509 | + <h3 class="no-ref no-num heading settled" id="w3c-conformant-algorithms"><span class="content">Conformant Algorithms</span><a class="self-link" href="#w3c-conformant-algorithms"></a></h3> |
| 1510 | + <p>Requirements phrased in the imperative as part of algorithms |
| 1511 | + (such as "strip any leading space characters" |
| 1512 | + or "return false and abort these steps") |
| 1513 | + are to be interpreted with the meaning of the key word |
| 1514 | + ("must", "should", "may", etc) |
| 1515 | + used in introducing the algorithm. </p> |
| 1516 | + <p>Conformance requirements phrased as algorithms or specific steps |
| 1517 | + can be implemented in any manner, |
| 1518 | + so long as the end result is equivalent. |
| 1519 | + In particular, the algorithms defined in this specification |
| 1520 | + are intended to be easy to understand |
| 1521 | + and are not intended to be performant. |
| 1522 | + Implementers are encouraged to optimize. </p> |
| 1523 | + </section> |
1493 | 1524 | </div>
|
1494 | 1525 | <script src="https://www.w3.org/scripts/TR/2021/fixup.js"></script>
|
1495 | 1526 | <h2 class="no-num no-ref heading settled" id="index"><span class="content">Index</span><a class="self-link" href="#index"></a></h2>
|
|
0 commit comments