DBSC on dbsc-on.cybersins.com
Device-bound session
Signing in here returns a Secure-Session-Registration header. A supporting browser generates a key pair in the TPM or Secure Enclave, proves possession of it, and from then on the session cookie lives for 90 seconds at a time and is renewed only by that device.
What to compare
Sign in on both hosts, export the cookie from each, and replay it with curl from
a different machine. The unbound cookie works for a month. The bound one stops working in under two minutes
and cannot be renewed, because renewal needs a signature from a private key that never leaves the original device.