Device-bound session credentialsLimited availability
Device-bound session credentials is a protocol to request proof of possession of a private key. Regularly confirming key possession can help protect against cookie theft.
Not yet supported in all major browsers — check the table and provide a fallback.
Browser support
DesktopChrome
✕Not supportedup to 155
Current: 155Edge
✕Not supportedup to 154
Current: 154Firefox
✕Not supportedup to 157
Current: 157Safari
✕Not supportedup to 27
Current: 27MobileChrome Android
✕Not supportedup to 155
Current: 155Firefox Android
✕Not supportedup to 157
Current: 157Safari iOS
✕Not supportedup to 27
Current: 27How to use
Not supported in Chrome, Edge, Firefox, Safari, Chrome Android, Firefox Android, Safari iOS. Use feature detection below and provide a fallback (or a polyfill) for those browsers.
Example
Full syntax and examples are on MDN — see the links below.
Feature detection
There’s no simple runtime check for this feature; rely on the support table and test in your target browsers.
Specification
Sub-features
Support for each part of the feature (5). The overall table above shows when the whole feature works.
| Sub-feature | Chrome | Edge | Firefox | Safari | Chrome Android | Firefox Android | Safari iOS |
|---|---|---|---|---|---|---|---|
| http.headers.Sec-Secure-Session-Id | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ |
| http.headers.Secure-Session-Challenge | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ |
| http.headers.Secure-Session-Registration | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ |
| http.headers.Secure-Session-Response | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ |
| http.headers.Secure-Session-Skipped | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ |