--- title: Device Trust for the Web: The Hard Parts | daily.dev description: Teleport explains how it extended device trust — previously only available in its CLI client — to web browser sessions starting with Teleport 16. Because... canonical: https://daily.dev/posts/device-trust-for-the-web-the-hard-parts-l7pe193bj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Device Trust for the Web: The Hard Parts | daily.dev og:description: Teleport explains how it extended device trust — previously only available in its CLI client — to web browser sessions starting with Teleport 16. Because... og:url: https://daily.dev/posts/device-trust-for-the-web-the-hard-parts-l7pe193bj og:image: https://api.daily.dev/og/posts/l7pE193BJ.png og:image:alt: Device Trust for the Web: The Hard Parts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Device Trust for the Web: The Hard Parts **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary Teleport explains how it extended device trust — previously only available in its CLI client — to web browser sessions starting with Teleport 16. Because browsers isolate access to secure hardware storing device private keys, the team designed a delegated authentication flow using their native Connect app to perform the cryptographic device authentication ceremony on the browser's behalf. The post walks through iterative design flaws: an initial webToken handoff scheme vulnerable to a stolen-credential attacker tricking a victim into authenticating on the attacker's behalf, mitigated first with IP matching, then hardened further with a 'token move' check where Connect opens the browser directly and a confirmation token must flow back through the same web session, preventing cross-machine token relay attacks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does device trust work for web browser sessions when private keys are stored in secure hardware the browser can't access? Device trust in the browser is handled through a delegated authentication flow where a native companion app (Connect) performs the actual device authentication ceremony, since browser isolation prevents direct access to hardware-backed keys in the Secure Enclave or TPMv2. The browser receives a device web token during login, hands it to Connect via a custom URL scheme, and Connect completes the cryptographic proof of possession on the device's behalf. _daily.dev surfaces deep dives like this for teams designing zero trust access without VPNs._ ### How can you prevent an attacker with stolen credentials from tricking a victim into approving device authentication on their behalf? A token move check closes this gap: instead of just matching source IPs, the delegated authenticator app must open the browser directly so both processes are provably co-located, then pass a device confirmation token back through that same browser session to Teleport. Any attempt to relay the token to a different session is detected as a sudden web session change and the authentication attempt fails. _developers hardening zero trust flows can find similar attack-and-defense writeups on daily.dev._ ### When did Teleport add device trust support for web-based access instead of just its CLI client tsh? Device trust was introduced in Teleport 12 but was limited to the CLI client (tsh) until Teleport 16, when web support was added through a delegated authentication design using the Connect desktop app to perform the hardware-backed device authentication ceremony on behalf of the browser. _daily.dev helps teams track feature rollouts like this across Teleport releases._ ## Similar posts on daily.dev - [A Beginners Guide: Cross-Device Passkeys](https://daily.dev/posts/a-beginners-guide-cross-device-passkeys-kmdfptph5) · Tech Lead Digest · 1 upvotes · 0 comments - [Hardening browser security with zero-trust controls](https://daily.dev/posts/hardening-browser-security-with-zero-trust-controls-dencxr7k7) · CSO Online · 0 upvotes · 0 comments - [Device Bound Session Credentials now available on Windows](https://daily.dev/posts/device-bound-session-credentials-now-available-on-windows-z7l2wmrgc) · Chrome Developers · 3 upvotes · 0 comments - [Passkeys are Your New Best Friend](https://daily.dev/posts/passkeys-are-your-new-best-friend-qhqzjdn9d) · Tech Lead Digest · 1 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/device-trust-for-the-web-the-hard-parts-l7pe193bj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Device Trust for the Web: The Hard Parts","url":"https://daily.dev/posts/device-trust-for-the-web-the-hard-parts-l7pe193bj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/device-trust-for-the-web-the-hard-parts-l7pe193bj"},"datePublished":"2026-08-23T12:22:49.731Z","dateModified":"2026-08-23T12:54:49.634Z","description":"Teleport explains how it extended device trust — previously only available in its CLI client — to web browser sessions starting with Teleport 16. Because...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/device-trust-for-the-web-the-hard-parts-l7pe193bj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,web-security","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Device Trust for the Web: The Hard Parts"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/device-trust-for-the-web-the-hard-parts-l7pe193bj#faq","mainEntity":[{"@type":"Question","name":"How does device trust work for web browser sessions when private keys are stored in secure hardware the browser can't access?","acceptedAnswer":{"@type":"Answer","text":"Device trust in the browser is handled through a delegated authentication flow where a native companion app (Connect) performs the actual device authentication ceremony, since browser isolation prevents direct access to hardware-backed keys in the Secure Enclave or TPMv2. The browser receives a device web token during login, hands it to Connect via a custom URL scheme, and Connect completes the cryptographic proof of possession on the device's behalf. daily.dev surfaces deep dives like this for teams designing zero trust access without VPNs."}},{"@type":"Question","name":"How can you prevent an attacker with stolen credentials from tricking a victim into approving device authentication on their behalf?","acceptedAnswer":{"@type":"Answer","text":"A token move check closes this gap: instead of just matching source IPs, the delegated authenticator app must open the browser directly so both processes are provably co-located, then pass a device confirmation token back through that same browser session to Teleport. Any attempt to relay the token to a different session is detected as a sudden web session change and the authentication attempt fails. developers hardening zero trust flows can find similar attack-and-defense writeups on daily.dev."}},{"@type":"Question","name":"When did Teleport add device trust support for web-based access instead of just its CLI client tsh?","acceptedAnswer":{"@type":"Answer","text":"Device trust was introduced in Teleport 12 but was limited to the CLI client (tsh) until Teleport 16, when web support was added through a delegated authentication design using the Connect desktop app to perform the hardware-backed device authentication ceremony on behalf of the browser. daily.dev helps teams track feature rollouts like this across Teleport releases."}}]} ```