Issues

• Registration request still requires an Authorization header that has been removed

  w3c/webappsec-dbsc#269 · Filter by author Sam-Hobson opened on Oct 11, 2026

• Implementation report: dbsc-server (TypeScript server library for Node, Bun, Deno)

  w3c/webappsec-dbsc#267 · Filter by author enda-kelly opened on Sep 4, 2026

• DBSC registration latency

  w3c/webappsec-dbsc#265 · Filter by author akhilsingh111 opened on Aug 25, 2026

• Ignore DBSC headers on connections with active TLS certificate errors

  w3c/webappsec-dbsc#264 · Filter by author alexilin92 opened on Jul 24, 2026

• Support for Linux with KDE Wallet (KWallet)

  w3c/webappsec-dbsc#261 · Filter by author saudiqbal opened on Jun 22, 2026

• Implementation Report: dbsc-toolkit (Node.js implementation of DBSC)

  w3c/webappsec-dbsc#260 · Filter by author SulimanAbdulrazzaq opened on May 24, 2026

• What should happen to RPs DBSC sessions when the SP session is terminated?

  w3c/webappsec-dbsc#259 · Filter by author adeinega opened on May 5, 2026
  1

• a session on the RP with the same key

  w3c/webappsec-dbsc#258 · Filter by author adeinega opened on May 4, 2026
  4

• Estimated Rollout for Android and iOS

  w3c/webappsec-dbsc#256 · Filter by author invisibleroads opened on May 1, 2026
  4

• Prevent risk of deadlock during session refresh

  w3c/webappsec-dbsc#255 · Filter by author alexilin92 opened on Apr 15, 2026

• Federated sessions (§ 3.3) orthogonal to your stated goals?

  w3c/webappsec-dbsc#254 · Filter by author maceip opened on Apr 14, 2026
  1

• Chrome DBSC: Session marked as session_ended despite valid challenge response

  w3c/webappsec-dbsc#243 · Filter by author jimmylo16 opened on Feb 5, 2026
  35

• Alternative short-lived refresh design

  w3c/webappsec-dbsc#238 · Filter by author martinthomson opened on Nov 21, 2025
  3

• Partitioned cookie support

  w3c/webappsec-dbsc#234 · Filter by author drubery opened on Nov 13, 2025

• Max-Age cookie attribute in JSON session credentials resulting in registration failure

  w3c/webappsec-dbsc#230 · Filter by author e-aakash opened on Oct 30, 2025
  3

• Changing which cookies are bound can be complex

  w3c/webappsec-dbsc#227 · Filter by author drubery opened on Oct 1, 2025

• Strategy for rejecting any non compliant DBSC user agent on the server side

  w3c/webappsec-dbsc#223 · Filter by author reda-alaoui opened on Sep 18, 2025
  1

• Evaluate new possible credential types

  w3c/webappsec-dbsc#211 · Filter by author drubery opened on Aug 15, 2025

• Make challenge lifetime browser-enforced

  w3c/webappsec-dbsc#210 · Filter by author drubery opened on Aug 15, 2025
  1

• JS bindings for usage of session keys

  w3c/webappsec-dbsc#177 · Filter by author drubery opened on May 12, 2025

• JS bindings for session registration

  w3c/webappsec-dbsc#176 · Filter by author drubery opened on May 12, 2025

• Consider Renaming "Device Bound Session Credentials" for Clarity

  w3c/webappsec-dbsc#152 · Filter by author kkoiwai opened on Apr 24, 2025
  1

• Synchronous operation and capability discovery

  w3c/webappsec-dbsc#117 · Filter by author sbweeden opened on Mar 17, 2025
  4

• HTTP Message Signatures

  w3c/webappsec-dbsc#112 · Filter by author jricher opened on Mar 5, 2025
  7

• Need for attestation?

  w3c/webappsec-dbsc#34 · Filter by author jackevans43 opened on Apr 7, 2024
  5