Open-Sourcing dbsc-php: a Server Library for Device Bound Session Credentials in PHP

dbsc-php is a newly open-sourced, MIT-licensed PHP library for implementing Device Bound Session Credentials (DBSC), a browser security mechanism that binds session cookies to a device-held private key, making stolen cookies useless. Built from real-world deployment experience at Report URI, the library is ~700 lines with zero dependencies beyond ext-openssl and ext-json. Key implementation gotchas documented include: registration being single-phase vs. refresh being two-phase, mandatory rotation of both cookie value and challenge on every refresh, correct header handling to avoid Chrome errors, and the critical requirement to store DBSC state in a dedicated key space (not a shared session blob) to avoid race conditions. The library is framework-agnostic, never touching superglobals or sending headers directly, and ships with an InMemoryStore for testing plus a full test harness covering attack scenarios.