← Back to feed / //dotnet

DBSC lands in ASP.NET Core: experimental cookie-theft protection in .NET 11 preview 8

.NET

Sep 26, 2026

5 reads 221 shares

AddDeviceBoundSession() ties auth cookies to a TPM-backed key so a stolen cookie can't be replayed elsewhere; HTTPS-only, Chromium-only, and staying in preview past .NET 11 GA.