Sec-Secure-Session-Id header

The refresh request’s Structured Field session identifier. It tells the server which stored public key, challenge window, and session record to load.

Syntax

Sec-Secure-Session-Id is a Structured Field string. Its string value contains only the opaque session identifier; parameters should be ignored.

Sec-Secure-Session-Id = sf-string
Sec-Secure-Session-Id: "session-42"

Inputs

Generate an unguessable server session identifier at registration and use it as the JSON session_identifier. On refresh, look it up in the server’s session database and select the stored DBSC public key and valid challenge set. Never infer identity from the header alone.

Outputs

The identifier has no standalone response. It enables a refresh endpoint to issue a challenge, validate the accompanying proof, refresh cookies, update instructions, or terminate the named DBSC session.

Errors

Reject an absent, malformed, unknown, expired, revoked, or unauthorized ID without disclosing account state. In the draft client algorithm, refresh 4xx responses other than the special 403 challenge path terminate the client DBSC session; choose response behavior deliberately and test it.

Context

The user agent adds this only to a refresh POST, not registration. The endpoint must remain same-site with the registered session and should not become a credentialed cross-origin probing endpoint.

Lifecycle

Created in the registration JSON, retained while the DBSC client session is valid, supplied on each refresh, and removed by client expiry, termination, clearing site data, or a new valid session replacing it. Server logout/revocation must delete the corresponding server record and expire its cookies.

Example

POST /dbsc/refresh HTTP/1.1
Host: app.example
Sec-Secure-Session-Id: "session-42"

HTTP/1.1 403 Forbidden
Secure-Session-Challenge: "fresh-nonce";id="session-42"

Compatibility

DBSC availability and standards position
Item	Requirement / behavior
Chrome	DBSC availability, not page-layout support: ChromeStatus lists DBSC as in development, with Chrome desktop milestone 145. Its Android milestone is null/unknown; availability remains controlled by implementation and feature configuration.
Firefox	No signal; the Mozilla standards-position issue is the public evidence, not an implementation commitment.
Safari	No signal; the WebKit standards-position issue is the public evidence, not an implementation commitment.
Other engines	Unknown. The W3C document is an Editor’s Draft, not a final interoperable Recommendation.

Security and privacy

Make IDs opaque and high entropy. Do not use a user ID, device ID, or a reusable cross-site identifier. Return uniform failures and rate-limit the endpoint to reduce login-state probing. The ID is an identifier, not a bearer proof.

Primary sources: sessionid · algorithms · chrome · rfc9651 · security. External sources open in a new tab.