Device-bound sessions with DBSC

Proposal Bind browser sessions to the device with [Device Bound Session Credentials]( (DBSC), so a copied session secret stops being enough to use a session. The browser handles the protocol, so SDKs don't change. Status: proposal, nothing prototyped. Support: Chrome 145 on Windows and 147 on macOS. [Firefox's position is negative]( and [Safari has given no signal]( so bound and unbound sessions must coexist. The [spec]( is still an editor's draft. Flow Gaps today | Today | Consequence | |---|---| | The session cookie holds the long-lived secret | No short-lived credential to bind | | The secret arrives by cookie, _legacy cookie, x-appwrite-session or x-fallback-cookies | Binding one cookie leaves three open | | Cross-site apps keep the secret in localStorage | It can be stolen without touching a cookie | | 9 sessionVerify call sites, including JWT creation, realtime and MQTT | Each is a possible bypass | | Shared hosts select the project by header, not path | Sc…