Device-Bound Session Tokens in JavaScript
Google’s recent announcement of a proposed ‘Device Bound Session Credentials’ feature[1] for Chrome reminded me of a project we worked on last year at my company. We focus on fraud prevention at signup and login (preventing multi-accounting and account theft), but some customers were concerned about post-login security and asked us to add a session hijacking prevention feature to our fraud prevention API. In the end, we decided to just implement a solution in Javascript. We call it session-lock, and it can be used today across all browsers[2] and, theoretically, native mobile apps. For a…
Device-Bound Session Tokens in JavaScript launched on April 16, 2024 with 23 votes, #819 of 4,347 launches that month and more than 75% of that year's launches. The site was still online in September 2026, 2 years on.
In plain words
Device-Bound Session Tokens in JavaScript is a security library that prevents session hijacking by binding session tokens to specific devices. Developed for fraud prevention specialists and application developers, it works across all browsers and theoretically supports native mobile apps. The tool creates a device-specific signing key pair using browser cryptography, storing the private key securely in IndexedDB and adding a device-bound signature to session tokens with each use, making stolen sessions unusable on other devices.
written from the facts on this page · September 2026
From the sources
session-lock: a token binding scheme and library
session-lock is a device-token binding scheme and JS library that reduces the risk of session hijacking / token replay attacks by binding the validity of a user's session token to their browser or device. Regardless of how strong a service's authentication mechanisms may be, if an attacker steals a user's session token, they can access protected resources belonging to the user much like they would if they had access to the user's authentication credentials. With the use of OS-level malware, malicious browser extensions, or traffic sniffing, an attacker can steal users' session tokens directly from their browsers or from the network, then use those tokens to authorize their own sessions.…from session-lock.keyri.com
In the maker’s words, at launch
Google’s recent announcement of a proposed ‘Device Bound Session Credentials’ feature[1] for Chrome reminded me of a project we worked on last year at my company. We focus on fraud prevention at signup and login (preventing multi-accounting and account theft), but some customers were concerned about post-login…
Does a similar job
all alternatives →
Storing Private Keys in the Browser Securely2024 · github.com · ▲10So the main purpose here is to show _a_ way that session-token theft can be mitigated. Clearly, this isn't NSA proof or something you'd use to secure a BL5 containment facility, but to prevent session-jacking; if feels like it could help a lot, and would be pretty quick and easy to roll out if an IDP wanted to implement it.
WebSession, a Secure Replacement for Cookies2023 · websession.dev · ▲182A protocol for secure browser sessions on the World Wide Web
PanicLock – Close your MacBook lid disable TouchID –> password unlockApr 2026 · github.com · ▲265I wrote this after the case of a Washington Post reporter, Hannah Natanson, was compelled to unlock her computer with her fingerprint. This resulted in access to her Desktop Signal on her computer, revealing sources and their conversations. https://www.yahoo.com/news/articles/washington-post-raid-pro... Edit: I've a lot more details about the legality and precedence on the apps landing page https://paniclock.github.io/
Link-lock – Distributed app to password-protect URLs2020 · github.com · ▲73Password-protect URLs using AES in the browser; create hidden bookmarks without a browser extension - jstrieb/link-lock
More dev tools this month
the category →
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 28d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 26d ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 23d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 21d ago · talanoa.email
CoreSpeed▲332One MCP for everything your agents need: apps, memory, tools
Dev tools · 28d ago · corespeed.io
Source: Show HN post ↗ · launch text quoted in part
Launched alongside, April 2024
the whole month →
Supabase▲2,325The Postgres developer platform is now generally available
Dev tools · 2024 · supabase.com
Cal.com Platform▲1,601Build your pixel-perfect booking experience with Atoms
Dev tools · 2024 · cal.com
deco.cx 2.0▲1,078Build web apps 10x faster with Deno, JSX, TS & Tailwind
Dev tools · 2024 · decocms.com
