Vercel rolls out protection against stolen session cookie attacks
Original title: Vercel rolls out new protection against stolen session cookie attacks
Vercel binds logins to device TPM to prevent stolen cookie reuse
Vercel is rolling out Device Bound Session Credentials which binds login sessions to a private key stored in the device's TPM. Even if the session cookie is stolen it cannot be reused on another device. The feature complements Chrome's App-Bound Encryption and is a gradual rollout to handle OAuth apps. Separately Security Review is in public beta for Pro and Enterprise teams to scan code changes on GitHub.
Unconfirmed: Whether any edge cases with OAuth apps were fully tested not stated
- Private key never retrieved by malware
- DBSC prevents stolen cookies on other devices
- Security Review flags missing authorization checks
- Scans free until November 10 2026
Impact: preventing reuse of stolen session cookies
- 1.Enable Device Bound Session Credentials
- 2.Use Security Review for code changes
- Vendors
- Vercel
- Products
- Vercel platformNext.js
From the original article
2 min read at bleepingcomputer.com
Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.