PHPackages                             spomky-labs/dbsc-bundle - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. spomky-labs/dbsc-bundle

ActiveSymfony-bundle[Security](/categories/security)

spomky-labs/dbsc-bundle
=======================

Device Bound Session Credentials (DBSC) for Symfony - protect sessions from cookie theft with hardware-bound keys.

0.3.0(1mo ago)31MITPHPPHP >=8.2CI passing

Since Jun 5Pushed 1mo agoCompare

[ Source](https://github.com/Spomky-Labs/dbsc-bundle)[ Packagist](https://packagist.org/packages/spomky-labs/dbsc-bundle)[ Docs](https://github.com/spomky-labs)[ RSS](/packages/spomky-labs-dbsc-bundle/feed)WikiDiscussions 0.4.x Synced 1w ago

READMEChangelog (3)Dependencies (12)Versions (8)Used By (0)

[![DBSC Bundle logo](doc/logo.svg)](doc/logo.svg)

DBSC Bundle
===========

[](#dbsc-bundle)

**Device Bound Session Credentials (DBSC)** for Symfony. It protects authenticated sessions from cookie theft by binding them to a hardware-backed private key (TPM) held by the user's browser.

> Status: **early work in progress**. The [DBSC specification](https://w3c.github.io/webappsec-dbsc/)is still a draft shipping behind a Chrome origin trial, so header names and payloads may change.

What it does
------------

[](#what-it-does)

DBSC complements your existing authentication (passwords, WebAuthn, SSO). It does not change how users log in: it hardens the credential that follows. After login the browser generates a device-bound key pair and proves possession of it periodically, so a stolen cookie replayed from another machine stops working. The browser drives all the cryptography; the server side is one response header plus two endpoints, all provided by this bundle. Browsers without DBSC support degrade gracefully.

Installation
------------

[](#installation)

```
composer require spomky-labs/dbsc-bundle
```

Getting started
---------------

[](#getting-started)

In **additive mode** a short, device-bound cookie is issued alongside your existing session, which stays authoritative. You opt in at login and allow the two endpoints; the firewall is unchanged.

When you are ready, DBSC can take over the long-lived credential (the remember-me role) with a single firewall key (`device_bound_session: true`).

See [Adoption modes](doc/modes.md) for both, including the opt-in badge and the access control to define.

Documentation
-------------

[](#documentation)

Full documentation lives in [`doc/`](doc/index.md):

- [Concepts and security model](doc/concepts.md)
- [Installation](doc/installation.md)
- [Configuration reference](doc/configuration.md)
- [Adoption modes](doc/modes.md)
- [Migrating from remember-me](doc/remember-me-migration.md)
- [Protocol and endpoints](doc/protocol.md)
- [Production storage](doc/storage.md)
- [Extending the bundle](doc/extending.md)

License
-------

[](#license)

MIT. See [LICENSE](LICENSE).

###  Health Score

37

—

LowBetter than 81% of packages

Maintenance90

Actively maintained with recent releases

Popularity5

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity41

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

7

Last Release

49d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/ccc6c59de7d9ddc53219653bc58f1e082ef83d96632d233eedc0b7097cf80ea3?d=identicon)[Spomky](/maintainers/Spomky)

---

Top Contributors

[![Spomky](https://avatars.githubusercontent.com/u/1091072?v=4)](https://github.com/Spomky "Spomky (24 commits)")

---

Tags

cookie-theftdbscdevice-bound-session-credentialssecuritysessionsymfonysymfony-bundletpmwebauthnsymfonybundlesecuritysessiondbscdevice-bound-session-credentialstpmcookie-theft

### Embed Badge

![Health badge](/badges/spomky-labs-dbsc-bundle/health.svg)

```
[![Health](https://phpackages.com/badges/spomky-labs-dbsc-bundle/health.svg)](https://phpackages.com/packages/spomky-labs-dbsc-bundle)
```

###  Alternatives

[symfony/security-bundle

Provides a tight integration of the Security component into the Symfony full-stack framework

2.5k185.6M2.4k](/packages/symfony-security-bundle)[sylius/sylius

E-Commerce platform for PHP, based on Symfony framework.

8.5k5.9M754](/packages/sylius-sylius)[sulu/sulu

Core framework that implements the functionality of the Sulu content management system

1.3k1.4M215](/packages/sulu-sulu)[easycorp/easyadmin-bundle

Admin generator for Symfony applications

4.3k17.9M400](/packages/easycorp-easyadmin-bundle)[web-auth/webauthn-framework

FIDO2/Webauthn library for PHP and Symfony Bundle.

515100.5k3](/packages/web-auth-webauthn-framework)[open-dxp/opendxp

Content & Product Management Framework (CMS/PIM)

9421.6k64](/packages/open-dxp-opendxp)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)