Vercel is gradually rolling out Device-Bound Session Credentials (DBSC) for logins to vercel.com, tying sessions to a specific device so a stolen browser cookie cannot be replayed from another computer. The change protects the accounts developers use to manage projects and deployments on the platform.
Vercel CTO Malte Ubl announced the rollout in an X post on November 3. DBSC keeps a private key in the device’s Trusted Platform Module (TPM) and requires the browser to prove possession of that key when renewing a session. A copied cookie alone cannot renew the session from a different device. Google’s DBSC documentation describes the short-lived cookie and proof-of-possession process.
Vercel is deploying the protection gradually while handling edge cases involving OAuth applications. The initial rollout works in Chrome on macOS and Windows. The company is also rolling out a related proof-of-possession technology, DPoP, for the Vercel CLI.
DBSC is designed to block reuse of stolen cookies, not to neutralize malware that remains active on the original device. Ubl said malware can still act while it is running on the user’s machine. Abijita previously covered Chrome 146’s DBSC protection and stolen Claude sessions that showed how hijacked sessions can be abused without a user’s password.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
